Fairphone 3 unbricking

Thykus · February 22, 2020, 11:38am

Hi everyone. I guess i bricked my new Fairphone 3 too when i try to boot from twrp. I tryed the solution in this thread but it didnt worked, so i need your help to find my mistake. The Fairphone didnt react on pressing buttons and the display stays black, if i connect it to the windows computer, it is detected as QUalcom HS-USB QDloader 9008. I changed the drivers to libusb 1.2.6 as explained in the readme.md and installed the requirements (pylzma couldnt get installed by pip, so i installed it through downloading pylzma-0.5.0-cp38-cp38-win_amd64.whl).

If i now start the edl tool i get the following:

C:\Users\Thykus\AppData\Local\Programs\Python\Python38>python edl.py wl unbrick
--loader=unbrick/prog_emmc_firehose_8953_ddr.mbn && python edl.py reset
Qualcomm Sahara / Firehose Client (c) B.Kerler 2018-2019.
__main__ - Using loader unbrick/prog_emmc_firehose_8953_ddr.mbn ...
__main__ - Waiting for the device
__main__ - Device detected :)
__main__ - Mode detected: sahara
Device is in EDL mode .. continuing.
Library.sahara -
------------------------
HWID:              0x000ba0e100000000 (MSM_ID:0x000ba0e1,OEM_ID:0x0000,MODEL_ID:
0x0000)
PK_HASH:           0xcc3153a80293939b90d02d3bf8b23e0292e452fef662c74998421adad42
a380f
Serial:            0x00291f26
SBL Version:       0x00000000

Successfully uploaded programmer :)
Library.firehose - Nop succeeded.
Library.firehose - <?xml version="1.0" encoding="UTF-8" ?><data><log value="logb
uf@0x080795A8 fh@0x08076410" /></data>
Library.firehose - TargetName=MSM8953
Library.firehose - MemoryName=eMMC
Library.firehose - Version=1
__main__ - Supported functions:
-----------------
program,write,read,patch
Qualcomm Sahara / Firehose Client (c) B.Kerler 2018-2019.
__main__ - Trying with no loader given ...
__main__ - Waiting for the device
__main__ - Device detected :)
__main__ - Mode detected: firehose
Library.firehose - Nop succeeded.
Library.firehose -
Library.firehose - TargetName=MSM8953
Library.firehose - MemoryName=eMMC
Library.firehose - Version=1
__main__ - Supported functions:
-----------------
program,write,read,patch
Library.firehose - Reset succeeded.

Any guesses what i did wrong? Thx alot!

basxto · February 22, 2020, 3:23pm

Is it possible that you pressed volume up and down instead of just down? Were you ever in fastboot mode? Fastboot mode a special screen where it tells you some system info.

If the bootloader crashes it would rather be in dump mode (900e) and not in EDL mode (9008).
When you are in EDL mode you have to keep the power button pressed for quite some time until it reebots. (A lot longer than in android)

Thykus · February 22, 2020, 5:01pm

I tryed every combination with 1,2 and 3 buttons, with different length, before i connect the Phone and after the process. If i connect the phone i took the battery out for a few seconds. After the edl tool is finished, my Phone disconnected from the Computer and immediately reconnect.

A few more infos about how it bricks: i rooted the phone and had twrp installed. I did this, because i wanted to restore the titanbackup backup at my new phone. First everything was fine and the Phone works, entering fastboot was also possibly. After that i went again to twrp and after i rebooted from this my Phone bricks. I cant remember for what i went again to twrp (i have to look at the downloaded files on my PC, but i am not at home at the moment).

k4y0z · February 22, 2020, 6:56pm

Just booting TWRP will not brick the device like you described.
That being said, I have not used edl.py on windows, although I’d expect it to work.
You can try checking out an older version of the tool, as there have been changes recently.

Thykus · February 22, 2020, 7:09pm

I tryed the tool on my windows tablet too, but i didnt worked also. Next one i would try is on a Linux system. Can i do this with a bootable USB Stick?

Edit: With a Linux System (Kubuntu) the unbricking process went flawless. Thx everyone for your great work

Paolo_Cavagnolo · May 9, 2020, 3:00pm

Stop the ModemManager worked for me!

systemctl stop ModemManager.service (something like that…)

Then I repeated the 1kOhm resistor trick and then FP3 finally evolve from the brick state.

Thank you so much,
Paolo

system · November 8, 2020, 3:13am

This topic was automatically closed 182 days after the last reply. New replies are no longer allowed.

Stefan · November 11, 2021, 9:35pm

Tomtom · November 30, 2022, 1:54pm

Hey, I bought a bunch of 1kOhm resistances that I’m not using anymore (those things can only be bought on the internet in packs nowadays), so if anyone needs one for this trick I can send it to them

nibor · February 6, 2023, 2:54pm

Thank you for this very detailed thread, especially to @k4y0z and @calvofl0 !

TLDR: I seem to have gotten into this situation, although the circumstances were different. I have tried unbricking following the detailed guide (disassembling and forcing EDL mode with L and K pins). But the EDL script is not (yet) successful.

Background:

currently totally black and silent: not turning on, no signal of charging
FP3 running on LineageOS since about August 2020
only problem in daily usage (since about 3 months):
charging worked not with any usb cable but only with some, and sometimes also only when plugged in one way, not the other way around (not sure if this could be related to the
recently phone was in normal standby mode, led flashing blue (probably indicating a new message)
→ pressed power button short, screen stayed black (tried few times)
→ connected to charger: no charging
→ pressed power button long to turn of: phone turned of
→ since without any sign of life:
not booting, no led, no vibration, no charging, no fastboot mode, screen always black
→ tried with all combination of simultaneous button press (Vol+, Vol-, Power) and with / without battery and USB connection

What I did:

I followed the steps in the list posted by @calvofl0
One remark: when cloning the EDL repo and following the install instruction there, there is no ./edl.py. The file is just called edl (maybe this was different when this thread was started?)

tested without bridging L and K: connecting the extracted mainboard+usbmodule to PC gives nothing in watch -n 0.1 lsusb
tested with L and K bridged with 1kOhm: connecting to PC shows Bus 001 Device 047: ID 05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode)

I took this as a good sign that not all is lost.
Now I wanted to read the partitions or the total flash storage. It tried the four versions of the command below directly after the QDL connection appeared on the console (each time freshly reconnecting the board to usb with bridged L and K):
./edl rl ~/FP3 --debugmode
./edl rf ~/FP3 --debugmode
./edl rl ~/FP3 --loader=unbrick/prog_emmc_firehose_8953_ddr.mbn --debugmode
./edl rf ~/FP3 --loader=unbrick/prog_emmc_firehose_8953_ddr.mbn --debugmode

None of these worked: I did not get any files in the specified ~/FP3. I used debug mode as I hope it may help to find out what’s the problem. The output of the first command is below (somewhat condensed). The others look very similar.
I didn’t dare to try the writing mode of the EDL script yet, as I was hoping the reading of partitions might help me to get the latest version of data stored on the phone.

Can anyone see if there could still be hope for this FP3, or is it just dead?

Outputs:

./edl rl ~/FP3_data --debugmode
                                                                                                                                   
Capstone library is missing (optional).
Keystone library is missing (optional).
Qualcomm Sahara / Firehose Client V3.60 (c) B.Kerler 2018-2022.
loader_utils - [LIB]: invalid literal for int() with base 16: 'prog'
loader_utils - [LIB]: invalid literal for int() with base 16: 'mprg8626'
loader_utils - [LIB]: invalid literal for int() with base 16: 'mprg8974'
loader_utils - [LIB]: invalid literal for int() with base 16: 'prog'
loader_utils - [LIB]: invalid literal for int() with base 16: 'mprg8974'
loader_utils - [LIB]: invalid literal for int() with base 16: 'prog'
loader_utils - [LIB]: invalid literal for int() with base 16: 'prog'
loader_utils - [LIB]: list index out of range
loader_utils - [LIB]: invalid literal for int() with base 16: 'prog'
loader_utils - [LIB]: list index out of range
loader_utils - [LIB]: invalid literal for int() with base 16: 'prog'
loader_utils - [LIB]: list index out of range
loader_utils - [LIB]: list index out of range
loader_utils - [LIB]: list index out of range
loader_utils - [LIB]: invalid literal for int() with base 16: 'prog'
loader_utils - [LIB]: list index out of range
loader_utils - [LIB]: list index out of range
main - Trying with no loader given ...
main - Waiting for the device
DeviceClass - [LIB]: Detaching kernel driver
main - Device detected :)
DeviceClass - [LIB]: read:0x30
DeviceClass - [LIB]: ['  File "/home/edl/./edl", line 391, in <module>\n    base.run()\n', '  File "/home/edl/./edl", line 299, in run\n    conninfo = self.doconnect(loop)\n', '  File "/home/edl/./edl", line 213, in doconnect\n    resp = self.sahara.connect()\n', '  File "/home/edl/edlclient/Library/sahara.py", line 111, in connect\n    v = self.cdc.read(length=0xC * 0x4,timeout=1)\n']
DeviceClass - [LIB]: RX:0100000030000000020000[...]
sahara - Protocol version: 2, Version supported: 1
main - Mode detected: sahara
DeviceClass - [LIB]: ['  File "/home/edl/./edl", line 391, in <module>\n    base.run()\n', '  File "/home/edl/./edl", line 338, in run\n    sahara_info = self.sahara.cmd_info()\n', '  File "/home/edl/edlclient/Library/sahara.py", line 212, in cmd_info\n    if self.enter_command_mode():\n', '  File "/home/edl/edlclient/Library/sahara.py", line 155, in enter_command_mode\n    if not self.cmd_hello(sahara_mode_t.SAHARA_MODE_COMMAND):\n']
DeviceClass - [LIB]: TX:0200000030000000020000[...]
DeviceClass - [LIB]: read:0x8
DeviceClass - [LIB]: ['  File "/home/edl/./edl", line 391, in <module>\n    base.run()\n', '  File "/home/edl/./edl", line 338, in run\n    sahara_info = self.sahara.cmd_info()\n', '  File "/home/edl/edlclient/Library/sahara.py", line 212, in cmd_info\n    if self.enter_command_mode():\n', '  File "/home/edl/edlclient/Library/sahara.py", line 157, in enter_command_mode\n    res = self.get_rsp()\n', '  File "/home/edl/edlclient/Library/sahara.py", line 64, in get_rsp\n    data = self.cdc.read()\n']

[...]

DeviceClass - [LIB]: RX:0e00000010000000030000[...]
DeviceClass - [LIB]: ['  File "/home/edl/./edl", line 391, in <module>\n    base.run()\n', '  File "/home/edl/./edl", line 338, in run\n    sahara_info = self.sahara.cmd_info()\n', '  File "/home/edl/edlclient/Library/sahara.py", line 216, in cmd_info\n    self.pkhash = self.cmdexec_get_pkhash()\n', '  File "/home/edl/edlclient/Library/sahara.py", line 186, in cmdexec_get_pkhash\n    res = self.cmd_exec(exec_cmd_t.SAHARA_EXEC_CMD_OEM_PK_HASH_READ)\n']
DeviceClass - [LIB]: TX:0f0000000c000000030000[...]
DeviceClass - [LIB]: cmd_exec:0x60
DeviceClass - [LIB]: ['  File "/home/edl/./edl", line 391, in <module>\n    base.run()\n', '  File "/home/edl/./edl", line 338, in run\n    sahara_info = self.sahara.cmd_info()\n', '  File "/home/edl/edlclient/Library/sahara.py", line 216, in cmd_info\n    self.pkhash = self.cmdexec_get_pkhash()\n', '  File "/home/edl/edlclient/Library/sahara.py", line 186, in cmdexec_get_pkhash\n    res = self.cmd_exec(exec_cmd_t.SAHARA_EXEC_CMD_OEM_PK_HASH_READ)\n']
DeviceClass - [LIB]: RX:cc3153a80293939b90d02d[...]
sahara - 
------------------------
HWID:              0x000ba0e100000000 (MSM_ID:0x000ba0e1,OEM_ID:0x0000,MODEL_ID:0x0000)
CPU detected:      "SDM632"
PK_HASH:           0xcc3153a80293939[...]
Serial:            0xb83

sahara - Possibly unfused device detected, so any loader should be fine...
sahara - Possible loader available: /home/edl/edlclient/../Loaders/asus_wingtech/000ba0e100000000_6d6287d60bc71172_fhprg_peek.bin
sahara - Possible loader available: /home/edl/edlclient/../Loaders/meizu/000ba0e100000000_c451a1168ef5c7c7_fhprg_peek.bin
sahara - Trying loader: /home/edl/edlclient/../Loaders/asus_wingtech/000ba0e100000000_6d6287d60bc71172_fhprg_peek.bin
DeviceClass - [LIB]: ['  File "/home/edl/./edl", line 391, in <module>\n    base.run()\n', '  File "/home/edl/./edl", line 338, in run\n    sahara_info = self.sahara.cmd_info()\n', '  File "/home/edl/edlclient/Library/sahara.py", line 307, in cmd_info\n    self.cmd_modeswitch(sahara_mode_t.SAHARA_MODE_COMMAND)\n']
DeviceClass - [LIB]: TX:0c0000000c000000030000[...]
DeviceClass - [LIB]: read:0x30
DeviceClass - [LIB]: ['  File "/home/edl/./edl", line 391, in <module>\n    base.run()\n', '  File "/home/edl/./edl", line 340, in run\n    resp = self.sahara.connect()\n', '  File "/home/edl/edlclient/Library/sahara.py", line 111, in connect\n    v = self.cdc.read(length=0xC * 0x4,timeout=1)\n']
DeviceClass - [LIB]: RX:0100000030000000020000[...]
sahara - Protocol version: 2, Version supported: 1
sahara - Uploading loader /home/edl/edlclient/../Loaders/asus_wingtech/000ba0e100000000_6d6287d60bc71172_fhprg_peek.bin ...
DeviceClass - [LIB]: ['  File "/home/edl/./edl", line 391, in <module>\n    base.run()\n', '  File "/home/edl/./edl", line 345, in run\n    mode = self.sahara.upload_loader()\n', '  File "/home/edl/edlclient/Library/sahara.py", line 511, in upload_loader\n    if not self.cmd_hello(sahara_mode_t.SAHARA_MODE_IMAGE_TX_PENDING):\n']
DeviceClass - [LIB]: TX:0200000030000000020000[...]
DeviceClass - [LIB]: read:0x14
DeviceClass - [LIB]: ['  File "/home/edl/./edl", line 391, in <module>\n    base.run()\n', '  File "/home/edl/./edl", line 345, in run\n    mode = self.sahara.upload_loader()\n', '  File "/home/edl/edlclient/Library/sahara.py", line 519, in upload_loader\n    resp = self.get_rsp()\n', '  File "/home/edl/edlclient/Library/sahara.py", line 64, in get_rsp\n    data = self.cdc.read()\n']
DeviceClass - [LIB]: RX:03000000140000000d0000[...]
sahara - 32-Bit mode detected.
sahara - Firehose mode detected, uploading...
DeviceClass - [LIB]: ['  File "/home/edl/./edl", line 391, in <module>\n    base.run()\n', '  File "/home/edl/./edl", line 345, in run\n    mode = self.sahara.upload_loader()\n']
DeviceClass - [LIB]: TX:7f454c4601010100000000[...]
DeviceClass - [LIB]: read:0x14
DeviceClass - [LIB]: ['  File "/home/edl/./edl", line 391, in <module>\n    base.run()\n', '  File "/home/edl/./edl", line 345, in run\n    mode = self.sahara.upload_loader()\n', '  File "/home/edl/edlclient/Library/sahara.py", line 519, in upload_loader\n    resp = self.get_rsp()\n', '  File "/home/edl/edlclient/Library/sahara.py", line 64, in get_rsp\n    data = self.cdc.read()\n']

[...]

DeviceClass - [LIB]: RX:03000000140000000d0000[...]
DeviceClass - [LIB]: ['  File "/home/edl/./edl", line 391, in <module>\n    base.run()\n', '  File "/home/edl/./edl", line 345, in run\n    mode = self.sahara.upload_loader()\n']
DeviceClass - [LIB]: TX:ffffffffffffffffffffff[...]
DeviceClass - [LIB]: read:0x14
DeviceClass - [LIB]: ['  File "/home/edl/./edl", line 391, in <module>\n    base.run()\n', '  File "/home/edl/./edl", line 345, in run\n    mode = self.sahara.upload_loader()\n', '  File "/home/edl/edlclient/Library/sahara.py", line 519, in upload_loader\n    resp = self.get_rsp()\n', '  File "/home/edl/edlclient/Library/sahara.py", line 64, in get_rsp\n    data = self.cdc.read()\n']
DeviceClass - [LIB]: RX:03000000140000000d0000[...]
DeviceClass - [LIB]: ['  File "/home/edl/./edl", line 391, in <module>\n    base.run()\n', '  File "/home/edl/./edl", line 345, in run\n    mode = self.sahara.upload_loader()\n']
DeviceClass - [LIB]: TX:000c5c70ff00000000045d[...]
DeviceClass - [LIB]: read:0x14
DeviceClass - [LIB]: ['  File "/home/edl/./edl", line 391, in <module>\n    base.run()\n', '  File "/home/edl/./edl", line 345, in run\n    mode = self.sahara.upload_loader()\n', '  File "/home/edl/edlclient/Library/sahara.py", line 519, in upload_loader\n    resp = self.get_rsp()\n', '  File "/home/edl/edlclient/Library/sahara.py", line 64, in get_rsp\n    data = self.cdc.read()\n']
DeviceClass - [LIB]: RX:03000000140000000d0000[...]
DeviceClass - [LIB]: ['  File "/home/edl/./edl", line 391, in <module>\n    base.run()\n', '  File "/home/edl/./edl", line 345, in run\n    mode = self.sahara.upload_loader()\n']
DeviceClass - [LIB]: TX:02aa9d10ff00000002559e...]
DeviceClass - [LIB]: read:0x14
DeviceClass - [LIB]: ['  File "/home/edl/./edl", line 391, in <module>\n    base.run()\n', '  File "/home/edl/./edl", line 345, in run\n    mode = self.sahara.upload_loader()\n', '  File "/home/edl/edlclient/Library/sahara.py", line 519, in upload_loader\n    resp = self.get_rsp()\n', '  File "/home/edl/edlclient/Library/sahara.py", line 64, in get_rsp\n    data = self.cdc.read()\n']
DeviceClass - [LIB]: RX:03000000140000000d0000[...]
DeviceClass - [LIB]: ['  File "/home/edl/./edl", line 391, in <module>\n    base.run()\n', '  File "/home/edl/./edl", line 345, in run\n    mode = self.sahara.upload_loader()\n']
DeviceClass - [LIB]: TX:0000000000000000000000[...]
DeviceClass - [LIB]: read:0x14
DeviceClass - [LIB]: ['  File "/home/edl/./edl", line 391, in <module>\n    base.run()\n', '  File "/home/edl/./edl", line 345, in run\n    mode = self.sahara.upload_loader()\n', '  File "/home/edl/edlclient/Library/sahara.py", line 519, in upload_loader\n    resp = self.get_rsp()\n', '  File "/home/edl/edlclient/Library/sahara.py", line 64, in get_rsp\n    data = self.cdc.read()\n']
DeviceClass - [LIB]: RX:03000000140000000d0000[...]
DeviceClass - [LIB]: ['  File "/home/edl/./edl", line 391, in <module>\n    base.run()\n', '  File "/home/edl/./edl", line 345, in run\n    mode = self.sahara.upload_loader()\n']
DeviceClass - [LIB]: TX:0000000000000000000000[...]
DeviceClass - [LIB]: read:0x10
DeviceClass - [LIB]: ['  File "/home/edl/./edl", line 391, in <module>\n    base.run()\n', '  File "/home/edl/./edl", line 345, in run\n    mode = self.sahara.upload_loader()\n', '  File "/home/edl/edlclient/Library/sahara.py", line 519, in upload_loader\n    resp = self.get_rsp()\n', '  File "/home/edl/edlclient/Library/sahara.py", line 64, in get_rsp\n    data = self.cdc.read()\n']
DeviceClass - [LIB]: RX:04000000100000000d0000[...]
DeviceClass - [LIB]: ['  File "/home/edl/./edl", line 391, in <module>\n    base.run()\n', '  File "/home/edl/./edl", line 345, in run\n    mode = self.sahara.upload_loader()\n', '  File "/home/edl/edlclient/Library/sahara.py", line 568, in upload_loader\n    if self.cmd_done():\n']
DeviceClass - [LIB]: TX:0500000008000000
DeviceClass - [LIB]: read:0xc
DeviceClass - [LIB]: ['  File "/home/edl/./edl", line 391, in <module>\n    base.run()\n', '  File "/home/edl/./edl", line 345, in run\n    mode = self.sahara.upload_loader()\n', '  File "/home/edl/edlclient/Library/sahara.py", line 568, in upload_loader\n    if self.cmd_done():\n', '  File "/home/edl/edlclient/Library/sahara.py", line 321, in cmd_done\n    res = self.get_rsp()\n', '  File "/home/edl/edlclient/Library/sahara.py", line 64, in get_rsp\n    data = self.cdc.read()\n']
DeviceClass - [LIB]: RX:060000000c000000000000[...]
sahara - Loader successfully uploaded.
main - Trying to connect to firehose loader ...
firehose_client
firehose_client - [LIB]: No --memory option set, we assume "eMMC" as default ..., if it fails, try using "--memory" with "UFS","NAND" or "spinor" instead !
DeviceClass - [LIB]: [Errno 110] Operation timed out
DeviceClass - [LIB]: [Errno 110] Operation timed out
DeviceClass - [LIB]: [Errno 110] Operation timed out
DeviceClass - [LIB]: Timed out
DeviceClass - [LIB]: Timed out
DeviceClass - [LIB]: Timed out
firehose - TargetName=
firehose - MemoryName=eMMC
firehose - Version=
firehose - Trying to read first storage sector...
DeviceClass - [LIB]: [Errno 110] Operation timed out
DeviceClass - [LIB]: [Errno 110] Operation timed out
DeviceClass - [LIB]: [Errno 110] Operation timed out
DeviceClass - [LIB]: Timed out
DeviceClass - [LIB]: Timed out
DeviceClass - [LIB]: Timed out