Fairphone 3 unbricking

[Wade_Williams]

thank you! I wanted to say at this point I have the phone completely disassembled , and yes I am pretty new to the world of linux. I currently have four different machines running different distributions of linux, so I will attempt to restart the process of following the instructions on one of them. I appreciate your offer to help, unfortunately I am not in Switzerland thank you for being willing to do a video call I greatly appreciate that offer !! I will attempt to follow the instructions again and reach out to you if I get stuck

[vgall]

I can’t download unbrick.zip (unbrick.zip | by k4y0z for Generic Device/Other) because of ‘no mirrors found’. Is there any fix for that??

[gapintheclouds]

I also can’t download it. @k4y0z, are you able to share it with us again?

If not, does anyone have a copy of unbrick.zip, that they downloaded before it disappeared?

[koumilak]

It would be a shame if that file was lost, but i think i remember that it was a generic SoC image, so maybe it could be found elsewhere?

[yvmuell]

Fairphone 3 unlocking without oem unlocking

I possibly have an easy way to unlock without factory resetting. Thanks to @Ingo for checking that The following will unlock your device without requiring oem unlock and without forcing a factory-reset. However since unlocking causes the decryption-keys to change wiping data is still necessary (as it can’t be decrypted anymore) Download devinfo-unlocked.gpx (1 MB) Reboot into fastboot fastboot flash devinfo devinfo-unlocked.gpx fastboot reboot bootloader

Whats the status of your phone?

[k4y0z]

This should be the original file
unbrick.zip.gpx (3.2 MB)

Same MD5 as the one listed on androidfilehost: a59d09ff96da937698267eb41d73d32d
Renamed to “.gpx” so I could upload here.

I can’t seem to be able to edit the OP, so if a mod could attach the file there, that would be appreciated.

[gapintheclouds]

That’s excellent. Thanks. I’ll give it a try this evening. I seem to currently be in EDL mode (ID 05c6:9008). Fingers crossed .

[gapintheclouds]

Hi again,

I feel like I’m making a bit of progress, but I’m hitting an error halfway through the edl wl unbrick command. I’ve copied the output below. Does anyone have any suggestions?

$ python3 edl wl unbrick --loader=unbrick/prog_emmc_firehose_8953_ddr.mbn
Qualcomm Sahara / Firehose Client V3.62 (c) B.Kerler 2018-2025.
main - Using loader unbrick/prog_emmc_firehose_8953_ddr.mbn ...
main - Waiting for the device
main - Device detected :)
sahara - Protocol version: 2, Version supported: 1
main - Mode detected: sahara
sahara - 
Version 0x2
------------------------
HWID:              0x000ba0e100000000 (MSM_ID:0x000ba0e1,OEM_ID:0x0000,MODEL_ID:0x0000)
CPU detected:      "SDM632"
PK_HASH:           0xcc3153a80293939b90d02d3bf8b23e0292e452fef662c74998421adad42a380f
Serial:            0xaa1eb49c

sahara - Protocol version: 2, Version supported: 1
sahara - Uploading loader unbrick/prog_emmc_firehose_8953_ddr.mbn ...
sahara - 32-Bit mode detected.
sahara - Firehose mode detected, uploading...
sahara - Loader successfully uploaded.
main - Trying to connect to firehose loader ...
firehose_client
firehose_client - [LIB]: No --memory option set, we assume "eMMC" as default ..., if it fails, try using "--memory" with "UFS","NAND" or "spinor" instead !
firehose - TargetName=MSM8953
firehose - MemoryName=eMMC
firehose - Version=1
firehose - Trying to read first storage sector...
firehose - Running configure...
firehose - Storage report:
firehose - total_blocks:122142720
firehose - block_size:512
firehose - page_size:512
firehose - num_physical:3
firehose - mfr_id:21
firehose - serial_num:237229245
firehose - fw_version:1
firehose - mem_type:eMMC
firehose - prod_name:RP64MB
firehose_client - Supported functions:
-----------------
modules
modules - [LIB]: 'Logger' object has no attribute 'loglevel'
Writing unbrick/sbl1_a.bin to partition sbl1_a.
firehose - 
Writing to physical partition 0, sector 524312, sectors 1024
Progress: |██████████| 100.0% Write (Sector 0x400 of 0x400, ) 18.51 MB/s                        
Writing unbrick/keymaster_a.bin to partition keymaster_a.
firehose - 
Writing to physical partition 0, sector 19145216, sectors 2048
Progress: |██████████| 100.0% Write (Sector 0x800 of 0x800, ) 19.59 MB/s                        
Writing unbrick/cmnlib_b.bin to partition cmnlib_b.
firehose - 
Writing to physical partition 0, sector 19139072, sectors 2048
Progress: |██████████| 100.0% Write (Sector 0x800 of 0x800, ) 18.90 MB/s                        
Writing unbrick/aboot_a.bin to partition aboot_a.
firehose - 
Writing to physical partition 0, sector 917504, sectors 6144
Progress: |██████████| 100.0% Write (Sector 0x1800 of 0x1800, ) 15.98 MB/s                      
firehose_client
firehose_client - [LIB]: Couldn't write partition prog_emmc_firehose_8953_ddr. Either wrong memorytype given or no gpt partition.
$

[k4y0z]

It looks like the tool has changed a bit and is trying to flash the prog_emmc_firehose_8953_ddr.mbn file.
Just move it outside of the unbrick directory and adapt the path for the --loader argument of your command

[gapintheclouds]

Really appreciate your help. Thanks!

That makes sense. It now gets a bit further before raising an error. It is repeatable. This feels like an actual memory write error of some sort. What do you think?

$ python3 edl wl unbrick --loader=unbrick_loader/prog_emmc_firehose_8953_ddr.mbn --memory "eMMC"
Qualcomm Sahara / Firehose Client V3.62 (c) B.Kerler 2018-2025.
main - Using loader unbrick_loader/prog_emmc_firehose_8953_ddr.mbn ...
main - Waiting for the device
main - Device detected :)
sahara - Protocol version: 2, Version supported: 1
main - Mode detected: sahara
sahara - 
Version 0x2
------------------------
HWID:              0x000ba0e100000000 (MSM_ID:0x000ba0e1,OEM_ID:0x0000,MODEL_ID:0x0000)
CPU detected:      "SDM632"
PK_HASH:           0xcc3153a80293939b90d02d3bf8b23e0292e452fef662c74998421adad42a380f
Serial:            0xaa1eb49c

sahara - Protocol version: 2, Version supported: 1
sahara - Uploading loader unbrick_loader/prog_emmc_firehose_8953_ddr.mbn ...
sahara - 32-Bit mode detected.
sahara - Firehose mode detected, uploading...
sahara - Loader successfully uploaded.
main - Trying to connect to firehose loader ...
firehose - TargetName=MSM8953
firehose - MemoryName=eMMC
firehose - Version=1
firehose - Trying to read first storage sector...
firehose - Running configure...
firehose - Storage report:
firehose - total_blocks:122142720
firehose - block_size:512
firehose - page_size:512
firehose - num_physical:3
firehose - mfr_id:21
firehose - serial_num:237229245
firehose - fw_version:1
firehose - mem_type:eMMC
firehose - prod_name:RP64MB
firehose_client - Supported functions:
-----------------
modules
modules - [LIB]: 'Logger' object has no attribute 'loglevel'
Writing unbrick/sbl1_a.bin to partition sbl1_a.
firehose - 
Writing to physical partition 0, sector 524312, sectors 1024
Progress: |██████████| 100.0% Write (Sector 0x400 of 0x400, ) 20.40 MB/s                        
Writing unbrick/keymaster_a.bin to partition keymaster_a.
firehose - 
Writing to physical partition 0, sector 19145216, sectors 2048
Progress: |██████████| 100.0% Write (Sector 0x800 of 0x800, ) 22.74 MB/s                        
Writing unbrick/cmnlib_b.bin to partition cmnlib_b.
firehose - 
Writing to physical partition 0, sector 19139072, sectors 2048
Progress: |██████████| 100.0% Write (Sector 0x800 of 0x800, ) 22.58 MB/s                        
Writing unbrick/aboot_a.bin to partition aboot_a.
firehose - 
Writing to physical partition 0, sector 917504, sectors 6144
Progress: |██████████| 100.0% Write (Sector 0x1800 of 0x1800, ) 15.58 MB/s                      
Writing unbrick/rpm_b.bin to partition rpm_b.
firehose - 
Writing to physical partition 0, sector 527384, sectors 1024
Progress: |██████████| 100.0% Write (Sector 0x400 of 0x400, ) 19.08 MB/s                        
Writing unbrick/devcfg_b.bin to partition devcfg_b.
firehose - 
Writing to physical partition 0, sector 537112, sectors 512
Progress: |██████████| 100.0% Write (Sector 0x200 of 0x200, ) 17.99 MB/s                        
Writing unbrick/tz_a.bin to partition tz_a.
firehose - 
Writing to physical partition 0, sector 528408, sectors 4096
Progress: |██████████| 100.0% Write (Sector 0x1000 of 0x1000, ) 24.38 MB/s                      
Writing unbrick/splash.bin to partition splash.
firehose - 
Writing to physical partition 0, sector 786432, sectors 22528
Progress: |██████████| 100.0% Write (Sector 0x5800 of 0x5800, ) 18.09 MB/s                      
Writing unbrick/lksecapp_a.bin to partition lksecapp_a.
firehose - 
Writing to physical partition 0, sector 19136512, sectors 256
Progress: |██████████| 100.0% Write (Sector 0x100 of 0x100, ) 20.11 MB/s                        
Writing unbrick/lksecapp_b.bin to partition lksecapp_b.
firehose - 
Writing to physical partition 0, sector 19136768, sectors 256
Progress: |██████████| 100.0% Write (Sector 0x100 of 0x100, ) 16.66 MB/s                        
Writing unbrick/cmnlib_a.bin to partition cmnlib_a.
firehose - 
Writing to physical partition 0, sector 19137024, sectors 2048
Progress: |██████████| 100.0% Write (Sector 0x800 of 0x800, ) 17.25 MB/s                        
Writing unbrick/aboot_b.bin to partition aboot_b.
firehose - 
Writing to physical partition 0, sector 923648, sectors 6144
Progress: |██████████| 100.0% Write (Sector 0x1800 of 0x1800, ) 9.01 MB/s                       
firehose_client
firehose_client - [LIB]: Couldn't write partition sbl1_b. Either wrong memorytype given or no gpt partition.
$

[k4y0z]

@gapintheclouds

sbl1_a.bin

Not sure about this one, but it seems to have successfully written sbl1_a.bin so you could try deleting sbl1_b.bin (it’s the same file) theoretically it should be enough, to get one of the two slots bootable again.

[FPbonn]

Which file prog_emmc_firehose_8953_ddr.mbn you are using exactly ?

$ find . -type f -iname 'prog_emmc_firehose_8953_ddr.mbn' | xargs sha256sum 
64c9d8fe95a2e23c9b05ac985d95948e19911f18ec98841cb2214a177296c8ac  ./Firehose-Finder/fh_collection/8403D39A/prog_emmc_firehose_8953_ddr.mbn
2107a6f06c1f19ff561b325f81f7d6b9a210c73bc3a77ba664ec841407e22d03  ./Firehose-Finder/fh_collection/CBAA55ED/1/prog_emmc_firehose_8953_ddr.mbn
2278af5872355ed22c845241ffbcf823e1536b12d5fd85dee0997f26147d133f  ./Firehose-Finder/fh_collection/56C276BD/1/prog_emmc_firehose_8953_ddr.mbn
5c41d24178e1c8f5cafd29789b2391d97966c0f12cceccf07c087e6ca7c38cc3  ./Firehose-Finder/fh_collection/88599034/1/prog_emmc_firehose_8953_ddr.mbn
2ba44888af1dc1c5332c6e7f637a411b29c35828fef1c662d492542e34af2521  ./Firehose-Finder/fh_collection/D33500D6/0/prog_emmc_firehose_8953_ddr.mbn
56ecac849dd161d850382988beb2560bf8a3c2f70bb5e7c255cab86caa4d6bf6  ./Programmers/prog_emmc_firehose_8953_ddr.mbn

As you can see, I have 6 different of them on my system.

[gapintheclouds]

Thanks for persisting with this. The unbrick command is running successfully, but the reset command is showing a USBError (see output below).

After unplugging the USB and reinserting the battery, I still can’t access fastboot. Running lsusb still shows EDL mode - Bus 001 Device 010: ID 05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode). I do have a spare bottom module I will try at the weekend.

$ python3 edl wl unbrick --loader=unbrick_loader/prog_emmc_firehose_8953_ddr.mbn
Qualcomm Sahara / Firehose Client V3.62 (c) B.Kerler 2018-2025.
main - Using loader unbrick_loader/prog_emmc_firehose_8953_ddr.mbn ...
main - Waiting for the device
main - Device detected :)
sahara - Protocol version: 2, Version supported: 1
main - Mode detected: sahara
sahara - 
Version 0x2
------------------------
HWID:              0x000ba0e100000000 (MSM_ID:0x000ba0e1,OEM_ID:0x0000,MODEL_ID:0x0000)
CPU detected:      "SDM632"
PK_HASH:           0xcc3153a80293939b90d02d3bf8b23e0292e452fef662c74998421adad42a380f
Serial:            0xaa1eb49c

sahara - Protocol version: 2, Version supported: 1
sahara - Uploading loader unbrick_loader/prog_emmc_firehose_8953_ddr.mbn ...
sahara - 32-Bit mode detected.
sahara - Firehose mode detected, uploading...
sahara - Loader successfully uploaded.
main - Trying to connect to firehose loader ...
firehose_client
firehose_client - [LIB]: No --memory option set, we assume "eMMC" as default ..., if it fails, try using "--memory" with "UFS","NAND" or "spinor" instead !
firehose - TargetName=MSM8953
firehose - MemoryName=eMMC
firehose - Version=1
firehose - Trying to read first storage sector...
firehose - Running configure...
firehose - Storage report:
firehose - total_blocks:122142720
firehose - block_size:512
firehose - page_size:512
firehose - num_physical:3
firehose - mfr_id:21
firehose - serial_num:237229245
firehose - fw_version:1
firehose - mem_type:eMMC
firehose - prod_name:RP64MB
firehose_client - Supported functions:
-----------------
modules
modules - [LIB]: 'Logger' object has no attribute 'loglevel'
Writing unbrick/sbl1_a.bin to partition sbl1_a.
firehose - 
Writing to physical partition 0, sector 524312, sectors 1024
Progress: |██████████| 100.0% Write (Sector 0x400 of 0x400, ) 19.13 MB/s      
Writing unbrick/keymaster_a.bin to partition keymaster_a.
firehose - 
Writing to physical partition 0, sector 19145216, sectors 2048
Progress: |██████████| 100.0% Write (Sector 0x800 of 0x800, ) 18.15 MB/s      
Writing unbrick/cmnlib_b.bin to partition cmnlib_b.
firehose - 
Writing to physical partition 0, sector 19139072, sectors 2048
Progress: |██████████| 100.0% Write (Sector 0x800 of 0x800, ) 20.87 MB/s      
Writing unbrick/aboot_a.bin to partition aboot_a.
firehose - 
Writing to physical partition 0, sector 917504, sectors 6144
Progress: |██████████| 100.0% Write (Sector 0x1800 of 0x1800, ) 15.72 MB/s    
Writing unbrick/rpm_b.bin to partition rpm_b.
firehose - 
Writing to physical partition 0, sector 527384, sectors 1024
Progress: |██████████| 100.0% Write (Sector 0x400 of 0x400, ) 19.19 MB/s      
Writing unbrick/devcfg_b.bin to partition devcfg_b.
firehose - 
Writing to physical partition 0, sector 537112, sectors 512
Progress: |██████████| 100.0% Write (Sector 0x200 of 0x200, ) 24.50 MB/s      
Writing unbrick/tz_a.bin to partition tz_a.
firehose - 
Writing to physical partition 0, sector 528408, sectors 4096
Progress: |██████████| 100.0% Write (Sector 0x1000 of 0x1000, ) 21.76 MB/s    
Writing unbrick/splash.bin to partition splash.
firehose - 
Writing to physical partition 0, sector 786432, sectors 22528
Progress: |██████████| 100.0% Write (Sector 0x5800 of 0x5800, ) 23.09 MB/s    
Writing unbrick/lksecapp_a.bin to partition lksecapp_a.
firehose - 
Writing to physical partition 0, sector 19136512, sectors 256
Progress: |██████████| 100.0% Write (Sector 0x100 of 0x100, ) 21.00 MB/s      
Writing unbrick/lksecapp_b.bin to partition lksecapp_b.
firehose - 
Writing to physical partition 0, sector 19136768, sectors 256
Progress: |██████████| 100.0% Write (Sector 0x100 of 0x100, ) 21.05 MB/s      
Writing unbrick/cmnlib_a.bin to partition cmnlib_a.
firehose - 
Writing to physical partition 0, sector 19137024, sectors 2048
Progress: |██████████| 100.0% Write (Sector 0x800 of 0x800, ) 21.20 MB/s      
Writing unbrick/aboot_b.bin to partition aboot_b.
firehose - 
Writing to physical partition 0, sector 923648, sectors 6144
Progress: |██████████| 100.0% Write (Sector 0x1800 of 0x1800, ) 16.25 MB/s    
Writing unbrick/cmnlib64_b.bin to partition cmnlib64_b.
firehose - 
Writing to physical partition 0, sector 19143168, sectors 2048
Progress: |██████████| 100.0% Write (Sector 0x800 of 0x800, ) 20.74 MB/s      
Writing unbrick/tz_b.bin to partition tz_b.
firehose - 
Writing to physical partition 0, sector 532504, sectors 4096
Progress: |██████████| 100.0% Write (Sector 0x1000 of 0x1000, ) 21.76 MB/s    
Writing unbrick/cmnlib64_a.bin to partition cmnlib64_a.
firehose - 
Writing to physical partition 0, sector 19141120, sectors 2048
Progress: |██████████| 100.0% Write (Sector 0x800 of 0x800, ) 16.91 MB/s      
Writing unbrick/devcfg_a.bin to partition devcfg_a.
firehose - 
Writing to physical partition 0, sector 536600, sectors 512
Progress: |██████████| 100.0% Write (Sector 0x200 of 0x200, ) 17.91 MB/s      
Writing unbrick/rpm_a.bin to partition rpm_a.
firehose - 
Writing to physical partition 0, sector 526360, sectors 1024
Progress: |██████████| 100.0% Write (Sector 0x400 of 0x400, ) 21.20 MB/s      
Writing unbrick/keymaster_b.bin to partition keymaster_b.
firehose - 
Writing to physical partition 0, sector 19147264, sectors 2048
Progress: |██████████| 100.0% Write (Sector 0x800 of 0x800, ) 20.93 MB/s      
$ python3 edl reset
Qualcomm Sahara / Firehose Client V3.62 (c) B.Kerler 2018-2025.
main - Trying with no loader given ...
main - Waiting for the device
main - Device detected :)
main - Mode detected: firehose
DeviceClass - USBError(5, 'Input/Output Error')
$

[k4y0z]

It looks like you were now able to flash everything but sbl1_b.bin.
You could try flashing only that file by deleting everything else form the folder.
Or by using a command like:
edl w sbl1_b unbrick/sbl1_b.bin
If that still gives you the memory error, there might indeed be an issue with your EMMC.
You could try dumping the content of your EMMC and comparing the files
edl printgpt
edl rl dumps --skip=userdata --genxml

Or only for the partitions contained in the unbrick.zip:

edl r aboot_a,aboot_b,cmnlib64_a,cmnlib64_b,cmnlib_a,cmnlib_b,devcfg_a,devcfg_b,keymaster_a,keymaster_b,lksecapp_a,lksecapp_b,rpm_a,rpm_b,sbl1_a,sbl1_b,splash,tz_a,tz_b aboot_a.img,aboot_b.img,cmnlib64_a.img,cmnlib64_b.img,cmnlib_a.img,cmnlib_b.img,devcfg_a.img,devcfg_b.img,keymaster_a.img,keymaster_b.img,lksecapp_a.img,lksecapp_b.img,rpm_a.img,rpm_b.img,sbl1_a.img,sbl1_b.img,splash.img,tz_a.img,tz_b.img

I don’t think a different bottom module will make a difference.

[gapintheclouds]

Thanks for your help with this. I really appreciate it.

Now when I try and run any edl command, it doesn’t get past firehose - Trying to read first storage sector…. It feels like an EMMC issue and I might have to give up. Maybe someone else have a go if they want .

Are there any data protection issues with donating the FP3 main module for spares? My understanding was that it should be fine as it was encrypted. Is that correct?

[UuBroot]

Hi, while playing around with my fairphone 3+ i accidently bricked it by corrupting the gpt partition. I’ve been trying to repair it for a few days now and i am beginning to think that my firehose loader file (prog_emmc_firehose_8953.mbn) isn’t made for my device spezificly since i got the file from a fairphone forum post for the standart fp3. Is there any other way to get my hand on this file?

[yvmuell]

Which forum post are you referring to? 3 or 3+ should not matter.

Fairphone 3 unbricking

Thanks for your help with this. I really appreciate it. Now when I try and run any edl command, it doesn’t get past firehose - Trying to read first storage sector…. It feels like an EMMC issue and I might have to give up. Maybe someone else have a go if they want . Are there any data protection issues with donating the FP3 main module for spares? My understanding was that it should be fine as it was encrypted. Is that correct?

[UuBroot]

Yes this is the post i meant this post.

https://forum.fairphone.com/t/fairphone-3-unbricking/57549

I tried it with both edl and QPST/QFIL but both had an Sahara protocol error, so i thought it may be the loader

[yvmuell]

Moved your post here as it makes more sense to have this together and maybe @k4y0z has any idea whats wrong