All MSM8905/8909 (Qualcomm 205/210) firehose loader collection initiative

[Luxferre]

Dear community,

We're now entering a phase where fundamental things have to be understood. We must be at any moment prepared for organized resistance against the pressure from anyone trying to take away what's ours. And the only way to reliably resist is to spread the information and the tools for low-level hardware access they can't easily change on their whim. Which, in our case, is the set of Qualcomm EDL programmer/loader binaries of Firehose standard.

So, let's collect the knowledge base of the loaders in this thread. My proposed format is the following:

- exact model name

- HWID (if known)

- exact filename (in an already uploaded archive) or a URL (if this is a new one)

Requirements to the files:

1. Must be easily downloadable (no turbobits/dfiles and other adware), preferably a direct link;

2. Individual loaders must have .mbn or .bin extension, archives should be preferably zip or 7z, no rar;

3. Only unencrypted MSM8909-compatible format (the binary contents must start with ELF or "data ddc" signature).

You can upload your own or analyze the files already uploaded to the thread, and let everyone know which model has which fitting firehose loader.

Let me start with my own current collection for today - https://cloud.disroot.org/s/HzxB6YM2wRFPpWT/download

So, I know the only file from this archive for sure:

Model: Alcatel OT-4044O (Cingular Flip 2)

HWID:  0x009600e100420024

Filename: prog_emmc_firehose_8909_alcF.mbn

Let's continue!

[Sylvain BLOT]

Hi,

Here is the Jiophone 2 firehose programmer.

[Luxferre]

CAT B35 loader found! It's already in the above archive.

Model: CAT B35

HWID: 0x000940e100000000

Filename: MSM8909.mbn

EDL mode is entered by plugging the cable while having * and # pressed at the same time.

P.S. Seems like CAT is using generic HWID for 8909 devices... We got very lucky with this.

[Luxferre]

Further updates on this thread will also be reflected at the special edl.bananahackers.net page which contains all known and verified firehose loaders table.

Sylvain, if you know HWID of JioPhone 2, could you pls post it as well?

[Vincent Vega]

Hello,

Somebody on this forum reports getting firehose working on 8110 but I don't have account there to ask what loader they use http://forum.gsmhosting.com/vbb/f296/nokia-8110-4g-full-support-infinity-qlm-1-16-a-2574130/

[Ivan Alex HC]

Hi, all you need is here http://dl1.infinity-box.com/00/pub.php?dir=software/

[Luxferre]

Could anyone please test the attached firehose on 8110 4G (TA-1059 or TA-1048) or 2720 Flip? I will be able to do this in 6 hours myself but probably someone will spread the great news before...

[PuriShnit]

Tried on both, 8110 & 2720. But unfortunately doesn't seem to work.

(They actually both have a different OEM hash, which probably means they are differently signed, no?)

[Luxferre]

Ok, let's forget about 2720 for now. Which version of 8110 do you have? TA-1048, TA-1059 or something else?

[PuriShnit]

TA-1059

[Luxferre]

Ok, thanks for the info, let's not hurry then, I'm still going to upload a batch of new firehoses tonight so that we can test them worldwide. I know that some of them must work at least for one 8110 version. The source is pretty much verified.

On Friday, February 21, 2020 at 4:49:52 PM UTC+2, PuriShnit wrote:

TA-1059

[PuriShnit]

Great news!

Looking forward...

[PuriShnit]

Just tried on a TA-1071 (single SIM), doesn't work either. 

However, the OEM hash is exactly the same as the TA-1059. Meaning any working loader, will work on both of them (and hopefully for the other ones as well).

[Luxferre]

So, the file is indeed correct but it's deliberately corrupted. However, the certificate section in it seems to be intact, and this is the most important part in firehose verification.

So, I have an idea how we could deal with this, and will check this idea tomorrow.

[Luxferre]

A working 8110 4G firehose found, should be compatible with any version. Updated on edl.bananahackers.net.

Model: Nokia 8110 4G

HWID: 0x000940e100420050

File: http://edl.bananahackers.net/loaders/0x000940e100420050.mbn
SHA256: 63b6e33d2776feb816bcc12926c25d75b664a1e728e296a4e1ecb3efe2449bc0

P.S. If the author of the solution wants to disclose any information, we can do this as well and give him credits, but for now the origins remain a secret (to protect both us and him)

[yair avramovitch]

Do you have Nokia 2720 flip mbn Or Nokia 800 tough mbn?

[hagen]

Nokia 800 Tough seems to have the same HWID. Does this mean, the firehose should work? I can't get it running, but I'm not sure, why. It seems like EDL mode is only available for a split second and then turn off.

HWID:              0x000940e100420050 (MSM_ID:0x000940e1,OEM_ID:0x0042,MODEL_ID:0x0050)
PK_HASH:           0x7fcdbae6d1b9526f3989d739f60fbfafb50cf3af73e263c67ad1a6ef1055f373
Serial:            ****
SBL Version:       0x00000000
 
Unexpected error on uploading, maybe signature of loader wasn't accepted ?

Sorry, couldn't talk to Sahara, please reboot the device !

[yair avramovitch]

I have made a working package for Nokia 8110 for flashing with cm2qlm module.
The Nokia 8110 not working on neither Nokia 800/2720.

[P MJ]

Could you share the procedure for using CM2QLM (including the software if possible) with file loader for Nokia 8110 4G TA-1059 as my device is bricked and can't enter recovery mode, but edl mode is available but showing the following error...

kali@kali:~/Desktop/edl-master$ python3 edl.py -loader 0x000940e100420050.mbn

Qualcomm Sahara / Firehose Client (c) B.Kerler 2018-2019.

Using loader 0x000940e100420050.mbn ...

Waiting for the device

Device detected :)

Mode detected: Unknown

Sorry, couldn't talk to Sahara, please reboot the device !

Note: I also tried with sudo  root permission but the same error occurs, and I am using the kali linux through VMware

Please do help in solving this Error or Provide the knowledge for unbricking my Nokia 8110 4g

Thank you all in Advance.......

[Luxferre]

The PK_HASH is what matters, not HWID.

[yair avramovitch]

So can you configure a firehose for nokia 2720/800?

[Luxferre]

No, that requires knowledge of the private signature keys.

[P MJ]

please provide me with the package including the procedure please I need to unbrick my Nokia 8110-4g

On Friday, 1 May 2020 19:09:20 UTC+5:30, yair avramovitch wrote:

[Luxferre]

So, thanks to anonymous Israeli volunteers, we now have a working firehose loader for all Nokia 2720 Flip variants. Added to the database.

[andyb...@gmail.com]

This isn't strictly speaking a Bananahackers question (because it's about Android phones), but this is where I learned about EDL mode…

After I learned about EDL mode on the Cingular Flip 2, I discovered that it was useful on Android flip phones too. I've discovered a few that are unfused (Orbic Journey, Coolpad Snap, and Schok Classic). But newer Schok Classic phones seem to have a fused loader.

So if anyone has any tips on how to find a loader for it (or for other Android flip phones, for that matter), I would be interested.

HWID: 0x009600e100000000 (MSM_ID:0x009600e1,OEM_ID:0x0000,MODEL_ID:0x0000) 

PK_HASH: 0xcc3153a80293939b90d02d3bf8b23e0292e452fef662c74998421adad42a380f 

Serial: 0x1c8d2181 

SBL Version: 0x00000000

[andyb...@gmail.com]

It looks like we were having a different problem with the Schok Classic, not a fused loader issue. Sorry for the false alarm.

[Stephen Smart]

This should be the emmc programmer for your specific model. Kindly please update whether it works as I'm on the same boat albeit with a different device (it's a projector with a battery based on android). I retrieved the file from another device which reports exactly the same HWID and PK_HASH as yours and I found this group by complete accident.

The following info was from the device that works with the programmer I attached

HWID:              0x009600e100000000 (MSM_ID:0x009600e1,OEM_ID:0x0000,MODEL_ID:0x0000)

PK_HASH:           0xcc3153a80293939b90d02d3bf8b23e0292e452fef662c74998421adad42a380f

[Andy Balholm]

Whether that file works for the Schok won't tell you much, because virtually any firehose file will work there.

Andy

--
You received this message because you are subscribed to a topic in the Google Groups "comp.mobile.nokia.8110" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/bananahackers/T2RmKKGvGNI/unsubscribe.
To unsubscribe from this group and all its topics, send an email to bananahacker...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/bananahackers/3c9cf64a-710b-4f36-9090-7a00bded4a99n%40googlegroups.com.

[Luxferre]

Andy, thanks a lot for figuring out the non-standard XML response for Nokias, merged your changes back into the https://github.com/plugnburn/edl fork.

[Luxferre]

Also, if you didn't notice, we also already have the 800 Tough firehose in our edl.bananahackers.net base.