# Touchpad Backup with QPST -- need this for unbricking



## mattv

Hello all -- Like many others, I have a bricked touchpad that shows up as Qualcomm QDLoader device. I've tried everything and read hundreds of threads, no love at all.

Today I stumbled upon some qualcomm software -- QPST. It's made for reading/writing to phones.

QPST sees my touchpad in download mode and it looks like it would let me flash the device's boot and system image memory areas......if I had the dumps.

Is there any way someone with a working touchpad would consider booting your TP into QDLoader mode (power + volume down) and doing the dumps with the "Software Download" module from QPST? There is a "backup" tab that creates a QCN file that it looks like I can restore to my touchpad and bring it back to life.

Anyone tried this already? If not -- would someone be onboard to help?

I downloaded the most recent build of QPST i could find from this thread on PPCGeeks and it recognizes my touchpad:
http://forum.ppcgeeks.com/windows-mobile-software/46873-updated-06-14-2011-qpst-qxdm.html

This is a direct link to the QPST version i'm using:
http://conflipper.com/Software/QPST_2.7_366.rar


----------



## nevertells

Man, I have not idea what you are talking about, and from the lack of replies, no one else does either. You need to Google WebOS Doctor, download the file, get version 3.0.5, and read up on how to use it. That's how you fix a bricked TouchPad.


----------



## mattv

I know all about WebOS Doctor and I've tried it dozens of times on multiple machines. My touchpad (and many other peope's as well) is stuck in "download mode". My google-fu is strong....VERY strong...and so are my troubleshooting and analysis skills. I've literally read hundreds of threads and chased down every option I've found during the past two weeks since my touchpad decided to off itself. I've even replaced the battery and accurately charged the original battery to refrence voltage levels outside of the touchpad using variable power supply....with no change to touchpad behavior

All someone needs to do is take a functional touchpad.......boot it by pressing power+volume down (DOWNLOAD MODE) -- install the QDLoader drivers that are availabe here on the RW forums...........install the QPST program that I posted.......use QPST to pull a qualcomm-formatted backup of the device....and post it up or send it to me. If restoring the qualcomm backup works, TONS of people with "stuck in download mode" touchpads will be able to recover their devices.

If you are going to do the backup to help me out --- I'd suggest doing a full backup of your touchpad and current config ---- WIPING DATA AND CACHE....then doing the qualcomm QPST backup....this way your personal information doesn't come with the QPST-formatted image you send me. After you're done with QPST --- you can restore the original backup that you created and get alll settings/data back with no fuss.

So -- no disrespect meant -- if you have any NEW ideas on how to fix a bricked touchpad other than webos doctor and/or pressing this or that button to make it reset......i'm all ears. If you're still with me -- how about firing up QPST and getting me a backup


----------



## pjt

Link to the [background=rgb(245, 245, 245)]QDLoader drivers?[/background]


----------



## nevertells

mattv said:


> So -- no disrespect meant -- if you have any NEW ideas on how to fix a bricked touchpad other than webos doctor and/or pressing this or that button to make it reset......i'm all ears. If you're still with me -- how about firing up QPST and getting me a backup


Sorry, not a chance pal. And good luck trying to find someone willing to risk bricking their TouchPad to try what you suggest.


----------



## netkillercat

so your saying people can backup the touchpad with this and re install the backup this makes ?

you saying this make a complete backup of the volume ?

or the internal drive

this make image of it right ?

just wondering


----------



## mattv

nevertells said:


> so your saying people can backup the touchpad with this and re install the backup this makes ?
> you saying this make a complete backup of the volume ?
> or the internal drive
> this make image of it right ?
> just wondering


I'm not positive, but I'm figuring that the QPST utility will backup the entire flash in a qualcomm-proprietary format.

to reiterate, here's what I would do if I had access to a functional touchpad

1) backup with rom-manager/clockworkmod or whatever
2) wipe data/cache
3) boot touchpad in Loader mode (pwr+volume down)
4) connect touchpad to computer, run SOFTWARE DOWNLOAD module of QPST -- click backup tab -- do the backup
5) back into clockworkmod -- restore the backup from step 1.

Anything you send or post would be a qualcomm-formatted dump with zero personal information or data.

thanks for reading.


----------



## TunG19

mattv said:


> to reiterate, here's what I would do if I had access to a functional touchpad
> 
> 1) backup with rom-manager/clockworkmod or whatever
> 2) wipe data/cache
> 3) boot touchpad in Loader mode (pwr+volume down)
> 4) connect touchpad to computer, run SOFTWARE DOWNLOAD module of QPST -- click backup tab -- do the backup
> 5) back into clockworkmod -- restore the backup from step 1.
> 
> Anything you send or post would be a qualcomm-formatted dump with zero personal information or data.
> 
> thanks for reading.


I tried to create the backup following your instructions, however when I click on start under the Backup tab I get a message saying
"Port does not contain a Phone in Diagnostic Mode" at the top of the QPST screen it indicates the port is in Download Mode.

I've used QPST in the past but I'm not overly familiar with it. If you have any ideas on how to put the TP in Diagnostic Mode I would be willing to try it.


----------



## mattv

@TunG19 -- thanks much for your efforts!

Not sure if this is going to work. I Got my hands on another touchpad and booted it into loader mode to try this --- when i went to do the download, QPST said the device was in "download" mode rather than "diagnostics" mode and wouldn't pull the image, same as your experience

My touchpad might be dead and out for the count. Frustrating.


----------



## nevertells

mattv said:


> @TunG19 -- thanks much for your efforts!
> 
> Not sure if this is going to work. I Got my hands on another touchpad and booted it into loader mode to try this --- when i went to do the download, QPST said the device was in "download" mode rather than "diagnostics" mode and wouldn't pull the image, same as your experience
> 
> My touchpad might be dead and out for the count. Frustrating.


Have you thought of contacting HP Tech support?


----------



## mattv

Yep, that was one of the first things I did. Since my touchpad is a refurb, it only had 60 days warranty. For the low price of $239 they will examine it and repair it if possible. Bleh!


----------



## sr3earjun

Hey Mattv, did you find any solution to your bricked HPtouch pad. I am also facing the Same issue.
I am able to install the QPST tools and able to see the device in "Download"mode, I am unable to reset this.
Please let me know if you have solution for this.


----------



## dadwarf

Hi,

I've got a Pre3 stuck in QDL (Qualcomm Download Mode) probably due to a BootLoader corruption.
The CPU of the Pre3 is the same in the TouchPad (in fact not really but both use the same CPU TYPE) *MSM7x30* so we are in the same boat !

After a lot research i found that it can be one of the BootLoader parts that can be the cause of the loop in QDL.
I found the files needed in the webosdoctor jar for my phone : partition.mbn, dbl.mbn, amss.mbn and osbl.mbn.
In QPST you need a BootLoader for the MSM7x30 (this one to be able to flash the files) the Pre3/TouchPad are an eMMC device so it must be called *EMPRG7x30.HEX*
(E for Emergency when device is in QDL, M for MMC, PRG is common and our CPU TYPE is 7x30)
I found that file (MPRG7x30.HEX is the same file as EMPRG7x30.HEX) on the web in a firmware package for another phone ... but ... in QPST i probably doing something wrong it give me an error :

*QPST 2.7-366 Software Download*
1. In Software Download tab if choose my *EMPRG7x30.HEX*
2. In Multi-image tab i choose the folder with my *.mbn files, i select *Sec Boot 2.0* as Boot System, i check Use Emerg. Host D/L
3. I press start ... and QPST answer *Could not open flash programming file*


----------



## cobjones

Any new luck?


----------



## Remolten

Could this fix the question mark of death???


----------



## cobjones

Remolten said:


> Could this fix the question mark of death???


After reading up on it yes, but I don't think we have a way to get it recognized yet.


----------



## drmarble

Perhaps jcsullins' tool for unbricking touchpads would help. He wrote it with the help of hp engineers while developing moboot. It repartions you sdcard into a more useable format. The link is: http://goo.im/devs/jcsullins/cmtouchpad/tools/uImage.tptoolbox_0.0.1
I've never used this tool and I think I have only read about it on irc. As I recall, you flash it in with novacom, just like acmeinstaller3:
novacom boot mem:// < uImage.tptoolbox_0.0.1
I really don't know more about it than this. It is supposed to be a last ditch effort to bring touchpad partitions back to life. Hope this helps.


----------



## Remolten

drmarble said:


> Perhaps jcsullins' tool for unbricking touchpads would help. He wrote it with the help of hp engineers while developing moboot. It repartions you sdcard into a more useable format. The link is: http://goo.im/devs/j...tptoolbox_0.0.1
> I've never used this tool and I think I have only read about it on irc. As I recall, you flash it in with novacom, just like acmeinstaller3:
> novacom boot mem:// < uImage.tptoolbox_0.0.1
> I really don't know more about it than this. It is supposed to be a last ditch effort to bring touchpad partitions back to life. Hope this helps.


My device isn't read by novacom when it's in qdloader mode I think.


----------



## wineaux

Have you asked on the HowardForums board about how to put a PalmPre cellphone into Dev Mode? As someone else mentioned, the Pre and the Touchpad are pretty similar in this regard. The folks over at HowardForums are THE cellphone gurus.

www.howardforums.com


----------



## nevertells

wineaux said:


> Have you asked on the HowardForums board about how to put a PalmPre cellphone into Dev Mode? As someone else mentioned, the Pre and the Touchpad are pretty similar in this regard. The folks over at HowardForums are THE cellphone gurus.
> 
> www.howardforums.com


To enter the Developer Mode on the tablet which is the equivalent of rooting the device, this is much simpler on WebOS than other platforms as proven by the method below.

In the Just Type search box at the top of any launcher screen, type in the following phrase:
webos20090606
Hit the Developer Mode icon that appears. DO NOT enter the requested developer mode password.
That's it, you're ready to install anything on your TouchPad.
Or watch this video:


----------



## Remolten

nevertells said:


> To enter the Developer Mode on the tablet which is the equivalent of rooting the device, this is much simpler on WebOS than other platforms as proven by the method below.
> 
> In the Just Type search box at the top of any launcher screen, type in the following phrase:
> webos20090606
> Hit the Developer Mode icon that appears. DO NOT enter the requested developer mode password.
> That's it, you're ready to install anything on your TouchPad.


Ah, you realize HP Touchpad is bricked it can't boot any OS to activate Dev Mode. If it's bricked, it means we have already rooted it.


----------



## wineaux

Sorry, I meant diagnostic mode so someone could make a QPST backup. Ask this on howardforums.


----------



## Remolten

wineaux said:


> Sorry, I meant diagnostic mode so someone could make a QPST backup. Ask this on howardforums.


That I believe is the solution.

From looking at other threads, I've determined that someone needs to make a full backup of an UNBRICKED Touchpad using QPST however no one has been able to yet because no one has "found" diagnostics mode which is what QPST errors when you try it in "download" mode. So we need to figure out how to get in diagnostics mode and then someone has to pull the files so we can use QPST to put the stuff on our BRICKED device in download mode.


----------



## wineaux

Remolten said:


> That I believe is the solution.
> 
> From looking at other threads, I've determined that someone needs to make a full backup of an UNBRICKED Touchpad using QPST however no one has been able to yet because no one has "found" diagnostics mode which is what QPST errors when you try it in "download" mode. So we need to figure out how to get in diagnostics mode and then someone has to pull the files so we can use QPST to put the stuff on our BRICKED device in download mode.


Correct! This is why I suggested HowardForums. Those folks are the phone geeks who figure out all of the hardware hacks. They may already have the answer to putting a WebOS device in Diagnostic Mode, and might even already have some basic images stored.


----------



## Remolten

wineaux said:


> Correct! This is why I suggested HowardForums. Those folks are the phone geeks who figure out all of the hardware hacks. They may already have the answer to putting a WebOS device in Diagnostic Mode, and might even already have some basic images stored.


Nothing found via google (even searcing pre 3) so looks like someone will have to join up and ask.


----------



## dadwarf

I managed to upload and execute MPRG7x30.HEX (eMMC Flash Programmer) via QPST or REVSKILLS (converted in bin and loaded at 0x80000000) on my Pre3 (the same CPU type as TouchPad).
But there, it says "hello" but without the source code of that bootloader i've no idea to what command send to it in order to flash some files (dbl.mbn, osbl.mnb ...)

With REVSKILLS you can try some commands : read and write memory ... but i don't know what to do with it !

Diagnostic Mode can't be accessed without a working device, if your are stuck in QCDL (Qualcomm Download Mode) you are in PBL (Primary Boot Loader) and the only thing you can do here is uploading a right bootloader !

If someone can help me find where is the souce code of MPRG7x30.HEX this man know all but has no name (a clue : "./AMSS/products/7x30/core/bsp/tools/emmcbld/build/MPRG7x30.HEX")​


----------



## Remolten

dadwarf said:


> I managed to upload and execute MPRG7x30.HEX (eMMC Flash Programmer) via QPST or REVSKILLS (converted in bin and loaded at 0x80000000) on my Pre3 (the same CPU type as TouchPad).
> But there, it says "hello" but without the source code of that bootloader i've no idea to what command send to it in order to flash some files (dbl.mbn, osbl.mnb ...)
> 
> With REVSKILLS you can try some commands : read and write memory ... but i don't know what to do with it !
> 
> Diagnostic Mode can't be accessed without a working device, if your are stuck in QCDL (Qualcomm Download Mode) you are in PBL (Primary Boot Loader) and the only thing you can do here is uploading a right bootloader !
> 
> If someone can find me where is the souce code of MPRG7x30.HEX this man know all but has no name (a clue : "
> ./AMSS/products/7x30/core/bsp/tools/emmcbld/build/MPRG7x30.HEX")


Maybe we can analyze open webOS source to find the files/commands?


----------



## dadwarf

Remolten said:


> Maybe we can analyze open webOS source to find the files/commands?


 In fact this bootloader is common to all Qualcomm device (HTC, HP, Samsung ... ) but it's good idea ! There is just link to opensource packages used in webOS nothing related to the boot loader.


----------



## Remolten

dadwarf said:


> In fact this bootloader is common to all Qualcomm device (HTC, HP, Samsung ... ) but it's good idea ! There is just link to opensource packages used in webOS nothing related to the boot loader.


That means someone with unbricked Touchpad needs to help which hopefully someone will. Start begging


----------



## wineaux

I have to send my Touchpad back to HP, so if you have the instructions to put my Touchpad into diagnostic mode, I can give it a try. I just need to make a full Nandroid backup first.


----------



## Remolten

wineaux said:


> I have to send my Touchpad back to HP, so if you have the instructions to put my Touchpad into diagnostic mode, I can give it a try. I just need to make a full Nandroid backup first.


We haven't figured out how to get diagnostic mode yet. However we will soon so hold tight.


----------



## dadwarf

Remolten said:


> We haven't figured out how to get diagnostic mode yet. However we will soon so hold tight.


 I think that you don't need a backup because you can't restore in Download Mode !
You need to fix one of the bootloaders before flashing back a stock firmware.

I tryed to talk to my Pre3 with REVSKILLS, it allows to send command and see directly what's happening :
I upload MPRG7x30.BIN (conversion of HEX to BIN) in memory (0x80000000)
Answer :


> 7E 02 51 43 4F 4D 20 66 61 73 74 20 64 6F 77
> 6E 6C 6F 61 64 20 70 72 6F 74 6F 63 6F 6C 20 74 61 72 67 03 02 00 04 00 00 00 00 00 00 04 65 4D
> 4D 43 1E 00 80 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00
> 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00
> 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00
> 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00
> 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00
> 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00
> 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00
> 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00
> 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00
> 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00
> 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00
> 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00
> 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00
> 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00
> 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00
> 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00 20 00 00 00
> 20 00 00 00 20 00 09
> 
> ~QCOM fast download protocol targ


Set Multimode to 03 (1B03) :



> 7E 0E 4E 6F 20 73 65 63 75 72 69 74 79 20 6D 6F 64 65 20 72 65 63 65 69 76 65 64 20 62 65 66
> 6F 72 65 20 6F 70 65 6E 20 6D 75 6C 74 69 0A
> 
> ~No security mode received before open multi


Security Mode enable (1701)



> 7E 18
> 
> ~


Set Multimode to 03 again (1B03) :



> 7E 0E 4E 6F 20 70 61 72 74 69 74 69 6F 6E 20 74 61 62 6C 65 20 72 65 63 65 69 76 65 64 20 62
> 65 66 6F 72 65 20 6F 70 65 6E 20 6D 75 6C 74 69 0A
> 
> ~No partition table received before open multi


Here i'am, the same answer as QPST !

There is a command in the list to send partition table but undocumented (1900 + data) ... i am alone :-(


----------



## Remolten

Okay I think I might have found the solution someone with unbricked Touchpad plz test.

1. Boot to webOS
2. On computer browser go to 
http://www.herrie.org/tpkeygen.html
3. Type in your serial # from Device Info
4. Write down the output

5. Go to Device Info - Custom Applications
6. Enter #*USBPASS#
7. Enter your output
8. If it works you get a application title that says:
USB Passthrough Control
9. You will see three options
Configure USBNet Passthrough
Run MiniDM Application
Configure Carrier Test (might be there???)
10. Click Configure USBNet Passthrough
11. Change first option to OFF
12. Enable Use USBNet

NOTE THAT THIS STEP 13 MIGHT BE THE ONLY ONE NEEDED SO IF ABOVE DOESN'T WORK JUST TRY THIS
13. Use xterm or such and type
mtp diag
14. Should output
{"returnValue:true"}
Pass-through enabled for Diag
15. Try connecting to computer and using QPST to make backup

ANOTHER OPTION
16. This might work without the previous also
17. Boot into USB Recover mode (Vol Up)
18. Connect to computer with novacom
19. Run
reset
20. Try QPST backup


----------



## Remolten

Remolten said:


> Okay I think I might have found the solution someone with unbricked Touchpad plz test.
> 
> 1. Boot to webOS
> 2. On computer browser go to
> http://www.herrie.org/tpkeygen.html
> 3. Type in your serial # from Device Info
> 4. Write down the output
> 
> 5. Go to Device Info - Custom Applications
> 6. Enter #*USBPASS#
> 7. Enter your output
> 8. If it works you get a application title that says:
> USB Passthrough Control
> 9. You will see three options
> Configure USBNet Passthrough
> Run MiniDM Application
> Configure Carrier Test (might be there???)
> 10. Click Configure USBNet Passthrough
> 11. Change first option to OFF
> 12. Enable Use USBNet
> 
> NOTE THAT THIS STEP 13 MIGHT BE THE ONLY ONE NEEDED SO IF ABOVE DOESN'T WORK JUST TRY THIS
> 13. Use xterm or such and type
> mtp diag
> 14. Should output
> {"returnValue:true"}
> Pass-through enabled for Diag
> 15. Try connecting to computer and using QPST to make backup
> 
> ANOTHER OPTION
> 16. This might work without the previous also
> 17. Boot into USB Recover mode (Vol Up)
> 18. Connect to computer with novacom
> 19. Run
> reset
> 20. Try QPST backup


Anyone tried this yet???


----------



## gk101

I am very much a novice but I do have one bricked touchpad and one working TP. I have QPST installed and I can see my bricked TP in download mode.

I don't 100% understand the @remolten instructions, I get lost at #13, but if someone wants to guide me through the process I'm willing to give it a shot.


----------



## Remolten

gk101 said:


> I am very much a novice but I do have one bricked touchpad and one working TP. I have QPST installed and I can see my bricked TP in download mode.
> 
> I don't 100% understand the @remolten instructions, I get lost at #13, but if someone wants to guide me through the process I'm willing to give it a shot.


Did you get through steps 1-12 without error???

If so:

13. Or put Touchpad in dev mode:
Type in webos20090606 into the search
Open the resulting application
Switch dev mode to on DON'T ENTER PASSWORD
Connect to computer and use WOSQI
http://forums.webosnation.com/canuck-coding/274461-webos-quick-install-v4-4-0-a.html
To connect via terminal to Touchpad
Then run:
mtp diag
Should output (if it works):
{"returnValue:true"}
Pass-through enabled for Diag
14. Connect to computer via USB cord
15. Type in windows start menu
device
16. Open up the application that comes up
Device Manager
17. Under
ports
The Touchpad should be listed as COM something
18. Take note of the port number
19. QPST Configuration
20. Add new port under port tab
21. Select the Touchpad's port
22. Make sure it is enabled
23. Click
Software Clients -> Software Download
24. Browse to the backup tab
25. Make sure Touchpad port is selected
26. For qcn file option choose where you want the backup to be saved
27. That's it!!! press start to make the backup
28. Check and make sure the backup file is more than 0kb
29. If it is zero kb run the backup again
30. You are hopefully done!!! Upload the file the some sort of file-sharing website so we can download


----------



## gk101

Remolten said:


> Did you get through steps 1-12 without error???
> 
> If so:
> 
> 13. Or put Touchpad in dev mode:
> Type in webos20090606 into the search
> Open the resulting application
> Switch dev mode to on DON'T ENTER PASSWORD
> Connect to computer and use WOSQI
> http://forums.webosn...l-v4-4-0-a.html
> To connect via terminal to Touchpad
> Then run:
> mtp diag
> Should output (if it works):
> {"returnValue:true"}
> Pass-through enabled for Diag
> 14. Connect to computer via USB cord
> 15. Type in windows start menu
> device
> 16. Open up the application that comes up
> Device Manager
> 17. Under
> ports
> The Touchpad should be listed as COM something
> 18. Take note of the port number
> 19. QPST Configuration
> 20. Add new port under port tab
> 21. Select the Touchpad's port
> 22. Make sure it is enabled
> 23. Click
> Software Clients -> Software Download
> 24. Browse to the backup tab
> 25. Make sure Touchpad port is selected
> 26. For qcn file option choose where you want the backup to be saved
> 27. That's it!!! press start to make the backup
> 28. Check and make sure the backup file is more than 0kb
> 29. If it is zero kb run the backup again
> 30. You are hopefully done!!! Upload the file the some sort of file-sharing website so we can download


When I enter the output(step 7) I get the following:
"can't get passthrough state: Service does not exist: com.palm.usbpassthrough"

Any ideas?


----------



## Remolten

gk101 said:


> When I enter the output(step 7) I get the following:
> "can't get passthrough state: Service does not exist: com.palm.usbpassthrough"
> 
> Any ideas?


OK Just follow the steps of my new post.

Just skip 1-12.


----------



## gk101

Within WOSQL I open the Linux Commandline, it recognizes my TP and I enter "mtp diag".

I get:
/bin/sh: mtp: not found


----------



## Remolten

Skip that step 13 and try this one instead:
13. Boot to USB Recovery mode
Connect with novacom via WOSQI
Run:
reset
or maybe???
diag

Then try completing 14-30.

if both of those don't work skip 13 and do 14-30 and tell me if you get any errors

EDIT:

13. I failed spelling error by me on that command it is:
mpt diag
not
mtp diag #Do the top command instead

Should output:
[background=rgb(245, 245, 245)]{"returnValue:true"}[/background]
[background=rgb(245, 245, 245)]Pass-through enabled for Diag[/background]

[background=rgb(245, 245, 245)]Do steps 14-30 now.[/background]


----------



## gk101

Same response:
/bin/sh: mpt: not found

Just sent a pm to maybe speed this up.


----------



## cyberprashant

watching this thread carefully - I have what I now believe is a bricked TP. Went dead all of a sudden - i thought it was a battery issue. Running CM9 dual boot. Just went dead all of a sudden one day. When plugged in - dead screen - It used to show as a Palm device when plugged in so let it sit a week to fully discharge, now it is detected as a qhsusb_dload device. Using QPST it is stuck in download mode. I hope someone can figure out how to unbrick it.


----------



## Remolten

cyberprashant said:


> watching this thread carefully - I have what I now believe is a bricked TP. Went dead all of a sudden - i thought it was a battery issue. Running CM9 dual boot. Just went dead all of a sudden one day. When plugged in - dead screen - It used to show as a Palm device when plugged in so let it sit a week to fully discharge, now it is detected as a qhsusb_dload device. Using QPST it is stuck in download mode. I hope someone can figure out how to unbrick it.


Do you get question mark of death???

If not you should have an easier unbricking.

EDIT:

Make sure dev mode is on

cd to /var/home/root 
then try mpt diag


----------



## cyberprashant

mine is like the OP - screen completely dead. Novacom won't recognize device, so commands to issue even. No question-mark or USB sign. Qualcomm QDLoader is all it is detected as when plugged in.


----------



## Remolten

cyberprashant said:


> mine is like the OP - screen completely dead. Novacom won't recognize device, so commands to issue even. No question-mark or USB sign. Qualcomm QDLoader is all it is detected as when plugged in.


you still got some hope as you don't have the question mark of death

I'm assuming you tried all the button combinations etc.

try to plug into computer with USB cord (trickle charge)


----------



## c0ns0le

Remolten said:


> Do you get question mark of death???
> 
> If not you should have an easier unbricking.
> 
> EDIT:
> 
> Make sure dev mode is on
> 
> cd to /var/home/root
> then try mpt diag


k. i too had been looking for ways to use qpst or qualcom utils for pandaboards etc to rewrite the mbn, looks like you may have gotten further, as i hadn't figured out how to get a backup and gave up due to time.

i'm working right now to try and revert my 32gb daily driver to stock webos from back when i bought it. I too am unable to find the mpt binary which does the flip. i've even tried just using the usb passthru to no avail as well.

i'm hopefull that i'll end up w/ a STOCK install of webos with the mpt tools avail. fyi, believe the command you're looking for ends up being 'mpt d usb'

but just guessing from the old sites i had used before. i'm on vaca this week, so hopefully i'll be able to spend a few hours daily messing w/ this.


----------



## c0ns0le

c0ns0le said:


> k. i too had been looking for ways to use qpst or qualcom utils for pandaboards etc to rewrite the mbn, looks like you may have gotten further, as i hadn't figured out how to get a backup and gave up due to time.
> 
> i'm working right now to try and revert my 32gb daily driver to stock webos from back when i bought it. I too am unable to find the mpt binary which does the flip. i've even tried just using the usb passthru to no avail as well.
> 
> i'm hopefull that i'll end up w/ a STOCK install of webos with the mpt tools avail. fyi, believe the command you're looking for ends up being 'mpt d usb'
> 
> but just guessing from the old sites i had used before. i'm on vaca this week, so hopefully i'll be able to spend a few hours daily messing w/ this.


k. i've reverted back to 'webOS 3.0.0' should be stock as it's webdoctored directy from the palm site.

manually patched the usbpassthrough files to grant visibility to the gui app.
i've searched all through this damned thing and cannot find 'mpt' or 'mtp' of any type on the touchpad firmware images.

i've resorted to alternate means now, am trying to use the luna-send commands, am having to figure out what the syntax needs to be for the specific app.

syntax will end up being something similar to:


Code:


<br />
luna-send -n 1 [URL=palm://com.palm.usbpassthrough]palm://com.palm.usbpassthrough[/URL] <commands><br />

out of curiosity, what version of webOS are these commands supposed to work?


----------



## c0ns0le

K. After digging through the /usr/palm/applications/com.palm.app.usbpassthrough/usbpassthrough-assistant.js

Executed


Code:


<br />
luna-send -i -a com.palm.app.usbpassthrough [URL=palm://com.palm.usbpassthrough/activate]palm://com.palm.usbpassthrough/activate[/URL] {}<br />

RETURN:


Code:


<br />
{"returnValue":false,"errorCode":-1,"errorText":"Not permitted to send to com.palm.usbpassthrough."}<br />

so trying jto get around the permissions issue, i've looked around and supposedly the '-a com.palm.app.usbpassthrough' portion is supposed to aid. I DON'T KNOW.. this is freaking pissing me off i can't get the blasted device into a passthrough diag mode. 

and more info.

mpt used to be in /usr/bin/mpt however it is no longer available on the system


Code:


<br />
[email protected]:/# find . -name mpt<br />
find . -name mpt<br />
[email protected]:/#<br />

i'll look into this more tomorrow. maybe there is a way to use jschullens tptoolbox. i've not booted w/ it yet. in fact i'll try that tonight.

i did some more digging. this time in the webosdoctor files themself. in fact in the webos doctor image it has the partition layout and information along with the specific images as well. i'm curious if we can't use one of the images provided in the webos doctor file to write out the bootloader.

DIRECTLY OUT OF THE webosdoctor305 file. \resources\webOS.tar topaz.xml


Code:


<br />
<?xml version="1.0" encoding="UTF-8"?><br />
<!-- Installer Rules for Topaz Hardware --><br />
<TrenchCoat><br />
<CPU type="MSM8660"/><br />
<Flash type="mmc" alignment="1" reusePartitions="true" device="/dev/mmcblk0"><br />
  <!-- Note: when modifying partitions, make sure to edit<br />
    the corresponding xml file in bootie-images --><br />
  <!-- Note: some entries marked "optional" for compatibility with older<br />
	   images. --><br />
  <Entry type="mbr" size="512" align="false"/><br />
  <Entry type="space" partition="0xc" size="1024KB" reformat="false"/>  <!-- p1, FAT (fat.bin) --><br />
  <Entry type="space" partition="0x4d" size="500KB" reformat="false"/>  <!-- p2, CFG_DATA; rpmsbl.mbn --><br />
  <Entry type="space" partition="0x51" size="1500KB" reformat="false"/>  <!-- p3, SPBL; spbl.mbn --><br />
  <!-- Here begins the extended partitions (extended partition p4) --><br />
  <Entry type="space" partition="0x47" size="500KB" reformat="false"/>  <!-- p5, APPSSBL; rpm.mbn --><br />
  <Entry type="space" partition="0x45" size="500KB" reformat="false"/>  <!-- p6, QCSBL; ssbl.mbn --><br />
  <Entry type="space" partition="0x4e" size="65024KB" reformat="false" optional="true"/> <!-- p7, EFS2 --><br />
  <Entry type="space" partition="0x4c" size="2500KB" reformat="false"/>  <!-- p8, FOTA; emmc_appsboot.mbn --><br />
  <Entry type="bootloader" partition="0x48" size="10240KB" reformat="false"/> <!-- p9, APPS; boot.img --><br />
  <Entry type="space" partition="0x46" size="500KB" reformat="false"/>  <!-- p10, OEMSBL; tz.mbn --><br />
  <Entry type="space" partition="0x4a" size="3072KB" reformat="false"/>  <!-- p11, MODEM_ST1 --><br />
  <Entry type="space" partition="0x4b" size="3072KB" reformat="false" optional="true"/> <!-- p12, MODEM_ST2 --><br />
  <!-- Here is palm territory.  There be dragons. --><br />
  <Entry type="nvram" size="4MB" reusePartition="false">	  <!-- p12, NVRAM --><br />
   <Section name="env" type="env" size="16KB"><br />
    <Val name="installer" value="trenchcoat"/><br />
    <Val name="autoboot" action="delete"/><br />
    <Val name="bootfile" action="delete"/><br />
   </Section><br />
   <Section name="tokens" type="token" size="10KB"><br />
    <Val name="installer" value="trenchcoat"/><br />
   </Section><br />
   <!-- IMPORTANT: Before adding any icons to this file, make sure that they're<br />
	 in the bootie-images package first.  Also, make sure icons are listed<br />
	 in nova/palm/classes/package_installer.bbclass before adding them here.<br />
	 Do this for ALL releases that will be using this xml file.  Do it BEFORE<br />
	 adding icons to this file. --><br />
   <Section name="logo-boot" type="image" file="BootLogo.tga"/><br />
   <Section name="logo-chg" type="image" file="Charging.tga"/><br />
   <Section name="logo-badchg" type="image" file="NoPower.tga"/><br />
   <Section name="logo-nobatt" type="image" file="NoBatt.tga"/><br />
   <Section name="logo-badsys" type="image" file="BadSys.tga"/><br />
   <Section name="logo-nosys" type="image" file="NoSys.tga"/><br />
   <Section name="logo-sync" type="image" file="Sync.tga"/><br />
   <Section name="logo-panic" type="image" file="Panic.tga"/><br />
   <Section name="logo-disk" type="image" file="Disk.tga"/><br />
   <Section name="logo-weak" type="image" file="Weak.tga"/><br />
  </Entry><br />
  <Entry type="ext3" size="32MB" reusePartition="false" mount="/boot"/>  <!-- p13, /boot --><br />
  <Entry type="lvm" id="pv" size="*" alignment="0x4000000" reusePartition="false" metadatasize="8MB" metadatacopies="2"/> <!-- p14, LVM --><br />
</Flash><br />
<VolumeGroups><br />
  <Group name="store" pv="pv" physicalextentsize="8MB"><br />
   <!-- Don't change the format of this next line, cust.bb parser depends on it. --><br />
   <Volume id="root" type="ext3" size="568MB" mount="/"/><br />
   <Volume id="var" type="ext3" size="64MB" mount="/var"/><br />
   <Volume id="update" type="ext3" size="16MB" mount="/var/lib/update"/><br />
   <Volume id="log" type="ext3" size="24MB" mount="/var/log"/><br />
   <Volume id="mojodb" type="ext3" size="8G:144MB,16G:256MB,32G:256M,64G:512M"/><br />
   <Volume id="filecache" type="ext3" size="136MB" inode_size="256"/><br />
   <Volume id="media" type="fat32" size="*" mount="/media/internal"/><br />
   <Volume id="swap" size="512MB"/><br />
  </Group><br />
</VolumeGroups><br />
<Filesystem fstab="/etc/fstab"><br />
  <Mount device="rootfs" mount="/" type="ext3" options="ro,suid,dev,exec,auto,nouser,async,noatime" freq="1" passno="1"/><br />
  <Mount id="var" options="noatime,data=writeback" freq="0" passno="0"/><br />
  <Mount device="/dev/mapper/store-cryptodb" type="ext3" options="noauto,noatime,data=ordered" freq="0" passno="0" mount="/var/db"/><br />
  <Mount device="/dev/mapper/store-cryptofilecache" type="ext3" options="noauto,noatime,user_xattr" freq="0" passno="0" mount="/var/file-cache"/><br />
  <Mount id="log" options="noatime" freq="0" passno="0"/><br />
  <Mount id="update" options="noauto,noatime" freq="0" passno="0"/><br />
  <Mount device="proc" mount="/proc" type="proc" options="defaults" freq="0" passno="0"/><br />
  <Mount device="devpts" mount="/dev/pts" type="devpts" options="mode=0620,gid=5" freq="0" passno="0"/><br />
  <Mount device="tmpfs" mount="/tmp" type="tmpfs" options="size=40M,mode=1777" freq="0" passno="0"/><br />
  <Mount device="tmpfs" mount="/var/run" type="tmpfs" options="size=16M,mode=1777" freq="0" passno="0"/><br />
  <Mount device="tmpfs" mount="/var/tmp" type="tmpfs" options="size=32M,mode=1777" freq="0" passno="0"/><br />
  <Mount device="tmpfs" mount="/media/ram" type="tmpfs" options="defaults" freq="0" passno="0"/><br />
  <Mount id="media" options="utf8,shortname=mixed,umask=0000" freq="0" passno="0"/><br />
</Filesystem><br />
<Images><br />
  <File file="${NOVATGZ}" target="/"/><br />
</Images><br />
<PostInstall file="/sbin/tcpostflash.sh"/><br />
</TrenchCoat<br />


----------



## Remolten

c0ns0le said:


> K. After digging through the /usr/palm/applications/com.palm.app.usbpassthrough/usbpassthrough-assistant.js
> 
> Executed
> 
> 
> Code:
> 
> 
> <br />
> luna-send -i -a com.palm.app.usbpassthrough [URL=palm://com.palm.usbpassthrough/activate]palm://com.palm.usbpassthrough/activate[/URL] {}<br />
> 
> RETURN:
> 
> 
> Code:
> 
> 
> <br />
> {"returnValue":false,"errorCode":-1,"errorText":"Not permitted to send to com.palm.usbpassthrough."}<br />
> 
> so trying jto get around the permissions issue, i've looked around and supposedly the '-a com.palm.app.usbpassthrough' portion is supposed to aid. I DON'T KNOW.. this is freaking pissing me off i can't get the blasted device into a passthrough diag mode.
> 
> and more info.
> 
> mpt used to be in /usr/bin/mpt however it is no longer available on the system
> 
> 
> Code:
> 
> 
> <br />
> [email protected]:/# find . -name mpt<br />
> find . -name mpt<br />
> [email protected]:/#<br />
> 
> i'll look into this more tomorrow. maybe there is a way to use jschullens tptoolbox. i've not booted w/ it yet. in fact i'll try that tonight.
> 
> i did some more digging. this time in the webosdoctor files themself. in fact in the webos doctor image it has the partition layout and information along with the specific images as well. i'm curious if we can't use one of the images provided in the webos doctor file to write out the bootloader.
> 
> DIRECTLY OUT OF THE webosdoctor305 file. \resources\webOS.tar topaz.xml
> 
> 
> Code:
> 
> 
> <br />
> <?xml version="1.0" encoding="UTF-8"?><br />
> <!-- Installer Rules for Topaz Hardware --><br />
> <TrenchCoat><br />
> <CPU type="MSM8660"/><br />
> <Flash type="mmc" alignment="1" reusePartitions="true" device="/dev/mmcblk0"><br />
> <!-- Note: when modifying partitions, make sure to edit<br />
> the corresponding xml file in bootie-images --><br />
> <!-- Note: some entries marked "optional" for compatibility with older<br />
> images. --><br />
> <Entry type="mbr" size="512" align="false"/><br />
> <Entry type="space" partition="0xc" size="1024KB" reformat="false"/>  <!-- p1, FAT (fat.bin) --><br />
> <Entry type="space" partition="0x4d" size="500KB" reformat="false"/>  <!-- p2, CFG_DATA; rpmsbl.mbn --><br />
> <Entry type="space" partition="0x51" size="1500KB" reformat="false"/>  <!-- p3, SPBL; spbl.mbn --><br />
> <!-- Here begins the extended partitions (extended partition p4) --><br />
> <Entry type="space" partition="0x47" size="500KB" reformat="false"/>  <!-- p5, APPSSBL; rpm.mbn --><br />
> <Entry type="space" partition="0x45" size="500KB" reformat="false"/>  <!-- p6, QCSBL; ssbl.mbn --><br />
> <Entry type="space" partition="0x4e" size="65024KB" reformat="false" optional="true"/> <!-- p7, EFS2 --><br />
> <Entry type="space" partition="0x4c" size="2500KB" reformat="false"/>  <!-- p8, FOTA; emmc_appsboot.mbn --><br />
> <Entry type="bootloader" partition="0x48" size="10240KB" reformat="false"/> <!-- p9, APPS; boot.img --><br />
> <Entry type="space" partition="0x46" size="500KB" reformat="false"/>  <!-- p10, OEMSBL; tz.mbn --><br />
> <Entry type="space" partition="0x4a" size="3072KB" reformat="false"/>  <!-- p11, MODEM_ST1 --><br />
> <Entry type="space" partition="0x4b" size="3072KB" reformat="false" optional="true"/> <!-- p12, MODEM_ST2 --><br />
> <!-- Here is palm territory.  There be dragons. --><br />
> <Entry type="nvram" size="4MB" reusePartition="false">	  <!-- p12, NVRAM --><br />
> <Section name="env" type="env" size="16KB"><br />
> <Val name="installer" value="trenchcoat"/><br />
> <Val name="autoboot" action="delete"/><br />
> <Val name="bootfile" action="delete"/><br />
> </Section><br />
> <Section name="tokens" type="token" size="10KB"><br />
> <Val name="installer" value="trenchcoat"/><br />
> </Section><br />
> <!-- IMPORTANT: Before adding any icons to this file, make sure that they're<br />
> in the bootie-images package first.  Also, make sure icons are listed<br />
> in nova/palm/classes/package_installer.bbclass before adding them here.<br />
> Do this for ALL releases that will be using this xml file.  Do it BEFORE<br />
> adding icons to this file. --><br />
> <Section name="logo-boot" type="image" file="BootLogo.tga"/><br />
> <Section name="logo-chg" type="image" file="Charging.tga"/><br />
> <Section name="logo-badchg" type="image" file="NoPower.tga"/><br />
> <Section name="logo-nobatt" type="image" file="NoBatt.tga"/><br />
> <Section name="logo-badsys" type="image" file="BadSys.tga"/><br />
> <Section name="logo-nosys" type="image" file="NoSys.tga"/><br />
> <Section name="logo-sync" type="image" file="Sync.tga"/><br />
> <Section name="logo-panic" type="image" file="Panic.tga"/><br />
> <Section name="logo-disk" type="image" file="Disk.tga"/><br />
> <Section name="logo-weak" type="image" file="Weak.tga"/><br />
> </Entry><br />
> <Entry type="ext3" size="32MB" reusePartition="false" mount="/boot"/>  <!-- p13, /boot --><br />
> <Entry type="lvm" id="pv" size="*" alignment="0x4000000" reusePartition="false" metadatasize="8MB" metadatacopies="2"/> <!-- p14, LVM --><br />
> </Flash><br />
> <VolumeGroups><br />
> <Group name="store" pv="pv" physicalextentsize="8MB"><br />
> <!-- Don't change the format of this next line, cust.bb parser depends on it. --><br />
> <Volume id="root" type="ext3" size="568MB" mount="/"/><br />
> <Volume id="var" type="ext3" size="64MB" mount="/var"/><br />
> <Volume id="update" type="ext3" size="16MB" mount="/var/lib/update"/><br />
> <Volume id="log" type="ext3" size="24MB" mount="/var/log"/><br />
> <Volume id="mojodb" type="ext3" size="8G:144MB,16G:256MB,32G:256M,64G:512M"/><br />
> <Volume id="filecache" type="ext3" size="136MB" inode_size="256"/><br />
> <Volume id="media" type="fat32" size="*" mount="/media/internal"/><br />
> <Volume id="swap" size="512MB"/><br />
> </Group><br />
> </VolumeGroups><br />
> <Filesystem fstab="/etc/fstab"><br />
> <Mount device="rootfs" mount="/" type="ext3" options="ro,suid,dev,exec,auto,nouser,async,noatime" freq="1" passno="1"/><br />
> <Mount id="var" options="noatime,data=writeback" freq="0" passno="0"/><br />
> <Mount device="/dev/mapper/store-cryptodb" type="ext3" options="noauto,noatime,data=ordered" freq="0" passno="0" mount="/var/db"/><br />
> <Mount device="/dev/mapper/store-cryptofilecache" type="ext3" options="noauto,noatime,user_xattr" freq="0" passno="0" mount="/var/file-cache"/><br />
> <Mount id="log" options="noatime" freq="0" passno="0"/><br />
> <Mount id="update" options="noauto,noatime" freq="0" passno="0"/><br />
> <Mount device="proc" mount="/proc" type="proc" options="defaults" freq="0" passno="0"/><br />
> <Mount device="devpts" mount="/dev/pts" type="devpts" options="mode=0620,gid=5" freq="0" passno="0"/><br />
> <Mount device="tmpfs" mount="/tmp" type="tmpfs" options="size=40M,mode=1777" freq="0" passno="0"/><br />
> <Mount device="tmpfs" mount="/var/run" type="tmpfs" options="size=16M,mode=1777" freq="0" passno="0"/><br />
> <Mount device="tmpfs" mount="/var/tmp" type="tmpfs" options="size=32M,mode=1777" freq="0" passno="0"/><br />
> <Mount device="tmpfs" mount="/media/ram" type="tmpfs" options="defaults" freq="0" passno="0"/><br />
> <Mount id="media" options="utf8,shortname=mixed,umask=0000" freq="0" passno="0"/><br />
> </Filesystem><br />
> <Images><br />
> <File file="${NOVATGZ}" target="/"/><br />
> </Images><br />
> <PostInstall file="/sbin/tcpostflash.sh"/><br />
> </TrenchCoat<br />


Are you in dev mode when you execute that command???

If not you better try again in dev mode because it could fix permission issues.

Also would you mind uploading some of these files you look into? I'm a fairly experienced programmer so if I had access to the files I could probably be of some help


----------



## cyberprashant

See this thread too - these ppl seem to be in the same situation iwth the QUSB_DLOAD error and somehow they got theirs to start charging. So my question is - is mine bricked really? I can get it to show Palm w/volume up and still shows QUSB when volume down - after charging for several days but I get no further. I had no luck following the procedure described there...I read also somewhere else that some ppl had luck with a touchstone charger?

http://forums.webosn...tml#post3355644

Anyone ever have luck installing a new battery?


----------



## Remolten

cyberprashant said:


> See this thread too - these ppl seem to be in the same situation iwth the QUSB_DLOAD error and somehow they got theirs to start charging. So my question is - is mine bricked really? I can get it to show Palm w/volume up and still shows QUSB when volume down - after charging for several days but I get no further. I had no luck following the procedure described there...I read also somewhere else that some ppl had luck with a touchstone charger?
> 
> http://forums.webosn...tml#post3355644
> 
> Anyone ever have luck installing a new battery?


What picture specifically can you get it to show???

FYI If you don't get question mark of death yours is not bricked yet.


----------



## c0ns0le

cyberprashant said:


> See this thread too - these ppl seem to be in the same situation iwth the QUSB_DLOAD error and somehow they got theirs to start charging. So my question is - is mine bricked really? I can get it to show Palm w/volume up and still shows QUSB when volume down - after charging for several days but I get no further. I had no luck following the procedure described there...I read also somewhere else that some ppl had luck with a touchstone charger?
> 
> http://forums.webosn...tml#post3355644
> 
> Anyone ever have luck installing a new battery?


I'm actually using a touchstone while I'm usb'd in for nova term while doing the work on a working tp

Sent from my SAMSUNG-SGH-I747 using Tapatalk 2


----------



## c0ns0le

Remolten said:


> What picture specifically can you get it to show???
> 
> FYI If you don't get question mark of death yours is not bricked yet.


Would seem to me he's in. Different place than bricked. Odd webosdoctor doesn't fix this.

Sent from my SAMSUNG-SGH-I747 using Tapatalk 2


----------



## c0ns0le

Btw blew out my back yesterday doing something not sure but ill try and get the files up for a short time on my Dropbox later as in likely tomorrow. You can get the same files from the palm site. But I'll see what I can do

Sent from my SAMSUNG-SGH-I747 using Tapatalk 2


----------



## Remolten

@console

Have you tried the commands in dev mode???


----------



## c0ns0le

Remolten said:


> @console
> 
> Have you tried the commands in dev mode???


Was pretty sure I was in dev mode, if I wasn't I'd not been able to execute the commands.

Sent from my cm_tenderloin using Tapatalk 2


----------



## cyberprashant

mine


Remolten said:


> What picture specifically can you get it to show???
> 
> FYI If you don't get question mark of death yours is not bricked yet.


no questionmark, - absoluately nothing on the display. I haven't seen anything on the display for weeks now. The only reason I know something happens is I get the QUSB_DLOAD when plug in and volume up/down and PALM when Volume down/up (not sure which volume key exactly).

So maybe its a bad display? Battery voltage when I popped it open was in the mid 2's - 2.7 I believe. So I'm thinking maybe I should try a ebay battery? Though it seems to me this is really a charging issue on mine. So maybe this thread is not for me then (i.e. NOT bricked).


----------



## Remolten

http://forums.webosnation.com/hp-touchpad/311955-bootie-mode-allows-image-backup.html

Apparently this backups the whole Touchpad???

If so someone can do this then post it online and we can restore via software download on QPST.


----------



## nevertells

cyberprashant said:


> mine
> 
> no questionmark, - absoluately nothing on the display. I haven't seen anything on the display for weeks now. The only reason I know something happens is I get the QUSB_DLOAD when plug in and volume up/down and PALM when Volume down/up (not sure which volume key exactly).
> 
> So maybe its a bad display? Battery voltage when I popped it open was in the mid 2's - 2.7 I believe. So I'm thinking maybe I should try a ebay battery? Though it seems to me this is really a charging issue on mine. So maybe this thread is not for me then (i.e. NOT bricked).


It's my understanding that a lithium ion battery that low is considered dead.


----------



## gk101

Remolten said:


> http://forums.webosn...age-backup.html
> 
> Apparently this backups the whole Touchpad???
> 
> If so someone can do this then post it online and we can restore via software download on QPST.


I ran Ubuntu 10.04 off a thumb drive however it still only showed up as "HP Touchpad" with the same cm9 files I can see in windows7.

I don't think I put it into "bootie mode" previously. Tried again:

1) Ran ubuntu 10.04 off a thumb drive
2) I put the TP into bootie mode by holding volume up, with the TP off, and plugged it into the computer.
3) The TP showed the USB symbol but the TP did not show up anywhere in ubuntu.


----------



## wineaux

Have you tried this yet?

* Can't boot into recovery mode?*

In the very unlikely event that your device will not boot into recovery mode (indicating that your boot loader on the flash disk may be damaged or corrupted) you can try booting bootie into recovery mode over USB instead: Last_Resort_Emergency_BootLoader_Recovery *Note that there has only been one incidence of this being required which ultimately was due to hardware failure, we do not recommend that you attempt this unless you have tried all the steps above exactly as described at least 10 times.*
Short of hardware damage, it should not be possible to "brick" a device.
*DANGER - The Veer definitely is brickable! *

There is a file you'll need to download at the top of the page. Oddly enough, it looks like it might be a LOT easier if you have a Mac. This certainly looks like it will fix a Touchpad where the bootloader itself if damaged, and I think that's what the you're seeing means. Notice the part where they are talking about putting the "castle" image onto your device. I think that's the missing/corrupted files that you need to be able to get into WebOSDoctor recovery mode. Give it a try. It doesn't sound like it could hurt things worse... LOL

This was found here: http://www.webos-internals.org/wiki/How_To_Recover


----------



## wineaux

I would also highly suggest reading this thread, as well as just doing a search on the term "QPST WebOS" on www.howardforums.com as you might turn up something else. Even if this isn't exactly what you're looking for, it most certainly will point you to specific users on howardforums who seem to really know the Pre's and WebOS. They may have a solution for you.

Good luck!


----------



## Remolten

wineaux said:


> Have you tried this yet?
> 
> * Can't boot into recovery mode?*
> 
> In the very unlikely event that your device will not boot into recovery mode (indicating that your boot loader on the flash disk may be damaged or corrupted) you can try booting bootie into recovery mode over USB instead: Last_Resort_Emergency_BootLoader_Recovery *Note that there has only been one incidence of this being required which ultimately was due to hardware failure, we do not recommend that you attempt this unless you have tried all the steps above exactly as described at least 10 times.*
> Short of hardware damage, it should not be possible to "brick" a device.
> *DANGER - The Veer definitely is brickable! *
> 
> There is a file you'll need to download at the top of the page. Oddly enough, it looks like it might be a LOT easier if you have a Mac. This certainly looks like it will fix a Touchpad where the bootloader itself if damaged, and I think that's what the you're seeing means. Notice the part where they are talking about putting the "castle" image onto your device. I think that's the missing/corrupted files that you need to be able to get into WebOSDoctor recovery mode. Give it a try. It doesn't sound like it could hurt things worse... LOL
> 
> This was found here: http://www.webos-int.../How_To_Recover


For the Pre I believe, not the Touchpad as the Touchpad's CPU is not an OMAP but a Qualcomm.


----------



## wineaux

Have you ever contacted HP support and asked them for the Touchpad's castle.img file? I'm still not 100% convinced that's a chipset specific IMG file. I get the feeling that's a backup of WebOS. However, even if it is just for the Pre, it's obvious that HP has the software tools available to fix your problem with the appropriate Castle file. If I were you, I'd try calling HP's WebOS tech support. You'll get India first, and their only answer may be to ship the Touchpad back to them and pay $380, but you'll have tried and covered that base. Once you've gotten the scripted tech support out of the way, then call HP's corporate office here in the States. They have an executive support team for people who have gotten nowhere with their outsourced support. THESE are the people who can most likely help you get things working again. The best part, is that once the right tools and image get out in the wild, then everyone with this problem can be helped. It was through this group that I got an out of warranty repair for the cracked case on my Touchpad at no charge. Give it a try.


----------



## Remolten

wineaux said:


> Have you ever contacted HP support and asked them for the Touchpad's castle.img file? I'm still not 100% convinced that's a chipset specific IMG file. I get the feeling that's a backup of WebOS. However, even if it is just for the Pre, it's obvious that HP has the software tools available to fix your problem with the appropriate Castle file. If I were you, I'd try calling HP's WebOS tech support. You'll get India first, and their only answer may be to ship the Touchpad back to them and pay $380, but you'll have tried and covered that base. Once you've gotten the scripted tech support out of the way, then call HP's corporate office here in the States. They have an executive support team for people who have gotten nowhere with their outsourced support. THESE are the people who can most likely help you get things working again. The best part, is that once the right tools and image get out in the wild, then everyone with this problem can be helped. It was through this group that I got an out of warranty repair for the cracked case on my Touchpad at no charge. Give it a try.


Contacted them via web support were they said that the repair would be like $385 or whatever. However, haven't tried on the phone.

Also those steps assume we can connect via novacom which we can't.


----------



## wineaux

If you already tried Web support, then call HPs corporate office here in the United States, and ask for their executive webOS support. answer the clothes and get you and out of warranty repair for free, or more importantly made it to provide us with program(s) and image in order to reflash a Touchpad.


----------



## Remolten

UPDATE:

Got Touchpad to show palm logo before going to question mark of death there is hope!!! Instructions coming.

EDIT:

Get Touchpad to Question Mark of Death then
Hold Power Home Vol Down and it should keep boot looping eventually palm logo starts appearing before the question mark each time


----------



## wineaux

Have you tried loading WebOS Doctor while doing that? Can you get it to recognize your Touchpad when the Palm logo flashes? This is why I think that you just need to get a castle img onto your device in order to get it working again.


----------



## Remolten

wineaux said:


> Have you tried loading WebOS Doctor while doing that? Can you get it to recognize your Touchpad when the Palm logo flashes? This is why I think that you just need to get a castle img onto your device in order to get it working again.


You can't novacom when you're not in bootie mode though so I can't. And webOS doctor only loads in bootie mode so it's probably a nogo.

UPDATE:

Got device to show up as Palm on windows.


----------



## wineaux

Remolten said:


> You can't novacom when you're not in bootie mode though so I can't. And webOS doctor only loads in bootie mode so it's probably a nogo.
> 
> UPDATE:
> 
> Got device to show up as Palm on windows.


I just found something that may help you! Watch this video.

http://www.souldevteam.net/blog/2012/07/24/fix-bricked-hp-touchpad-recovering-software-bricked-touchpad/


----------



## wineaux

http://forums.webosnation.com/hp-touchpad/310779-help-device-stopped-webos-doctor-not-working.html

Read this one too! It's not Castle for the Touchpad, it's Topaz. There is a link in that thread to another where someone sussed it out and got it working!

http://forums.webosnation.com/hp-touchpad/310473-help-installed-linux-now-i-cant-log-webos-profile.html is that thread.

And both of those threads reference to the wiki I posted earlier here: http://en.webos-internals.org/wiki/How_To_Recover

So, those threads should have the changes and data you need to make the wiki instructions work for unbricking your Touchpad!


----------



## dadwarf

wineaux said:


> http://forums.webosn...ot-working.html
> 
> Read this one too! It's not Castle for the Touchpad, it's Topaz. There is a link in that thread to another where someone sussed it out and got it working!
> 
> http://forums.webosn...os-profile.html is that thread.
> 
> And both of those threads reference to the wiki I posted earlier here: http://en.webos-inte.../How_To_Recover
> 
> So, those threads should have the changes and data you need to make the wiki instructions work for unbricking your Touchpad!


The CPU of the TouchPad is no longer a TI OMAP but a Qualcomm SnapDragon ... the wiki is about OMAP only (pre, pixie, pre2) !


----------



## dadwarf

Have you tried dfu-util ? 
I read an IRC logs about TouchPad in QDL mode and someone seems have succeed to send boot-topaz.bin with dfu-util !
It doesn't works with my Pre3 ...


----------



## gk101

Remolten said:


> You can't novacom when you're not in bootie mode though so I can't. And webOS doctor only loads in bootie mode so it's probably a nogo.
> 
> UPDATE:
> 
> Got device to show up as Palm on windows.


Are you seeing the palm logo on the TP screen or in windows device manager?

I'm having the same experience as others on windows7, where home+power+vol up gets me a palm logo w/exclamation mark(drivers not found) in device manager and home+power+vol down gets Qualcomm HS-USB QDLoader9008 to show in device manager. This is the only sign of life I ever get.


----------



## wineaux

dadwarf said:


> The CPU of the TouchPad is no longer a TI OMAP but a Qualcomm SnapDragon ... the wiki is about OMAP only (pre, pixie, pre2) !


Correct. But if you read the threads I linked, the basics still apply. The difference is that you're dealing with the Topaz IMG file instead of the Castle IMG file. The linked threads contain a discussion where someone found the differences, found where the correct Topaz IMG file(s) were stored, and then was able to unbrick their Touchpad using them and the basic methods described in that wiki. Again, read the thread. The wiki does pertain to the Touchpad once you know what files you're looking for to fix a Touchpad, and some specific changes to the instructions to accomodate them. From what I can see, it looks like 80-90% of the wiki still directly pertains to the Touchpad as well as the Pre. The remaining 10-20% that is different is contained within those two threads I linked.


----------



## Remolten

Have replicated the palm logo appearing on the device a few times now.

We should be going on IRC sometime who agrees???


----------



## c0ns0le

Remolten said:


> Have replicated the palm logo appearing on the device a few times now.
> 
> We should be going on IRC sometime who agrees???


I'm working on using the omap-u-boot-utils. Just found the info about it as it replaces the old omap-usbload. Google it you'll see the source and binaries.

Sent from my SAMSUNG-SGH-I747 using Tapatalk 2


----------



## dadwarf

Remolten said:


> Have replicated the palm logo appearing on the device a few times now.
> 
> We should be going on IRC sometime who agrees???


Great ! How have you done that ?


----------



## Remolten

c0ns0le said:


> Great ! How have you done that ?


I've gotten it to work with both Power + Home and Power + Home + Volume Down. If you haven't noticed, before it displays they question mark it has a ~2 second delay in which the screen is on but empty then it shows the question mark. All you do is hold one of these combinations down and boot loop it over and over. Occasionally (randomly) you get the palm logo instead of the blank screen before it shows the question mark. However, I've not been able to press Volume Up etc. during the time it shows up so who knows?!? Something else I've noticed is, whenever you hold Volume Up before the Touchpad actually turns on, it will not turn on. However you can get it to reboot from the question mark holding Volume Up with Power and Home and you can press and hold it after the Touchpad turns on; but not before. So it's like it refuses to try to even go to recovery mode which is annoying.


----------



## dadwarf

Remolten said:


> I've gotten it to work with both Power + Home and Power + Home + Volume Down. If you haven't noticed, before it displays they question mark it has a ~2 second delay in which the screen is on but empty then it shows the question mark. All you do is hold one of these combinations down and boot loop it over and over. Occasionally (randomly) you get the palm logo instead of the blank screen before it shows the question mark. However, I've not been able to press Volume Up etc. during the time it shows up so who knows?!? Something else I've noticed is, whenever you hold Volume Up before the Touchpad actually turns on, it will not turn on. However you can get it to reboot from the question mark holding Volume Up with Power and Home and you can press and hold it after the Touchpad turns on; but not before. So it's like it refuses to try to even go to recovery mode which is annoying.


I think it works for you because your eMMC is not completely corrupted, I never saw anything on screen with my Pre3 :-(
I try to give a chance to omap3_usbload.c ... but of course whole source code is oriented for Omap, there is really nothing to do with it your right !
You'll probably be able to webosdoctor your TouchPad if you are able to exit QDL (if there is something on screen that mean that your are elsewhere !).
I'm still trying to do something with emmcbld.bin but ... i feel alone ... it could be a fastboot for webos device !
That's awful no clue, there must be someone with the knowledge on the web ????


----------



## Remolten

dadwarf said:


> I think it works for you because your eMMC is not completely corrupted, I never saw anything on screen with my Pre3 :-(
> I try to give a chance to omap3_usbload.c ... but of course whole source code is oriented for Omap, there is really nothing to do with it your right !
> You'll probably be able to webosdoctor your TouchPad if you are able to exit QDL (if there is something on screen that mean that your are elsewhere !).
> I'm still trying to do something with emmcbld.bin but ... i feel alone ... it could be a fastboot for webos device !
> That's awful no clue, there must be someone with the knowledge on the web ????


For the Pre huge support on forums.webosnation.com

Look for rwhitby head of webosinternals

Gonna try to trigger recovery mode now. Boot looping here we come







.


----------



## Remolten

Haven't got a chance to do much recently. Anyone else had any luck???


----------



## Remolten

Unless we uncover something soon I'm going to be calling HP about his and try to get an out of warranty repair.


----------



## bryantjopplin

Do you need that topaz.bin file? I just read this whole topic and there is so much differences. If one could go into diagnostic mode who's to say it will upload a dual boot touch pad? I am willing to try some things but first I think we need to figure out these different modes? I know where that topaz bin file is as where somehow I flashed it using nova term to get mine back up from the palm.com/rom error.

Sent from my cm_tenderloin using Tapatalk 2


----------



## bryantjopplin

I think I used it that way. I was button mashing basically lol

Sent from my cm_tenderloin using Tapatalk 2


----------



## bryantjopplin

Sorry found out to put it in diagnostic mode it has to be running on webos . And then the com port then can be activated. I actually got an HTC phone to do this once.

Sent from my cm_tenderloin using Tapatalk 2


----------



## bryantjopplin

Look under change settings but read the whole page especially where it says usb pass thru 
http://en.m.webos-internals.org/wiki/WebOS_Hash_Codes?wasRedirected=true
I don't think this is what you want to put you device in as in needs to be running 
Sent from my cm_tenderloin using Tapatalk 2


----------



## bryantjopplin

Also read the entire thing like I did lol. Seems jcsullins and gang have fixed this b4

http://irclog.netripper.com/msm-bootloader/2011/9/20/

Sent from my cm_tenderloin using Tapatalk 2


----------



## dadwarf

bryantjopplin said:


> Also read the entire thing like I did lol. Seems jcsullins and gang have fixed this b4
> 
> http://irclog.netrip...ader/2011/9/20/
> 
> Sent from my cm_tenderloin using Tapatalk 2


In fact if you read whole logs it appears that they DIDN'T fix that !
QDL is still a problem for them ... and if hackers / coders can't ... we can't !


----------



## Remolten

You know how we typed in ##USBPASS# or whatever it was to try it. Well apparently MSL is required so try this first and record what it says.

##MSL#
or 
#MSL#
or 
#*MSL#

Try this before doing the USBPASS then see if it works.


----------



## bryantjopplin

dadwarf said:


> In fact if you read whole logs it appears that they DIDN'T fix that !
> QDL is still a problem for them ... and if hackers / coders can't ... we can't !


Jcsullins said he was able to do it using meta doctor and dfu util to push boot.bin. He even said that if was a Lil scary.

Sent from my Galaxy Nexus using Tapatalk 2


----------



## Remolten

I've read those logs through and through before and they are talking about a Touchpad *STUCK* in QDL mode not a Touchpad that can just boot to QDL mode.


----------



## bryantjopplin

Look where he says he recovered by using dfu to dump boot.bin










Sent from my Galaxy Nexus using Tapatalk 2


----------



## dadwarf

DFU is not QDL to enter in DFU you must be in bootie ... we are in PBL (primary Boot Loader) nowhere else !


----------



## dadwarf

This logs is one years old ... they stop working on it !


----------



## wineaux

Has anyone yet called HP's US based WebOS tech support to find out if they can supply any tools or images to help get you out of PBL? I mean they have to have them internally, and since this is now an orphaned product and WebOS is in the public domain, one would think that they'd also be willing to release some of their internal repair tools. Why in the world would they not do so?


----------



## bryantjopplin

DFU= DEVICE FIRMWARE UTILITY. it's a third party app that is used from reading this site http://dfu-util.gnumonks.org/

I believe they used this to flash bootie aka

Sent from my Galaxy Nexus using Tapatalk 2


----------



## bryantjopplin

bryantjopplin said:


> DFU= DEVICE FIRMWARE UTILITY. it's a third party app that is used from reading this site http://dfu-util.gnumonks.org/
> 
> I believe they used this to flash bootie aka second bootloader. The first loads the second and if the second is bad it puts you into DFU mode.
> 
> Sent from my Galaxy Nexus using Tapatalk 2


Sent from my Galaxy Nexus using Tapatalk 2


----------



## bryantjopplin

Sent from my Galaxy Nexus using Tapatalk 2


----------



## Remolten

dadwarf said:


> DFU= DEVICE FIRMWARE UTILITY. it's a third party app that is used from reading this site http://dfu-util.gnumonks.org/
> 
> I believe they used this to flash bootie aka
> 
> Sent from my Galaxy Nexus using Tapatalk 2


Reading the logs that is one conclusion you could possibly draw. However, just because it might have been achieved, it isn't documented and jcsullins has pretty much fallen off the face of the earth. The situation is also different as they were using working devices that didn't have the question mark of death.


----------



## bryantjopplin

Remolten said:


> That is correct.
> 
> Yep maybe more than a year old.
> 
> That is probably what I will be doing soon. Calling them and HP corporal offices.
> 
> Reading the logs that is one conclusion you could possibly draw. However, just because it might have been achieved, it isn't documented and jcsullins has pretty much fallen off the face of the earth. The situation is also different as they were using working devices that didn't have the question mark of death.


Could you upload a pic of your screen? I have never seen that before. I have been trying to get mine to that. Lol. Isn't this usbpass through just to enable the device to be powered through usb so it can be programmed

Sent from my Galaxy Nexus using Tapatalk 2


----------



## dadwarf

I don't want to be rude, my english is not enough rich to write correct sentences but i'm sure of the way to solve our problem and no one help me, why ???

We are in QDL, that's a fact, we can't quit QDL for another state that's a fact too so ... we have to use QDL !
QDL is a Download mode, waiting for a Bootloader so ... we must send a bootloader !
We have the bootloader, is name is emmcbld for my Pre3 it's the file MPRG7x30.HEX and for TouchPad the file (could be) MPRG8660.HEX.
QPST can send it to the device, for REVSKILLS it needs to be converted (HEX to BIN) and to be loaded at 0x80000000 and pbl.pl (based on GobyLoader) can send it too. The device answer but the bootloader is undocumented ...

Can someone try with the TouchPad ????
Download Revskills (Windows)
Install QHUSB drivers (64bits - 32/64bits from RiffJtag installer)
Donwnload MPRG7X30.BIN (Pre3) or MPRG8660.BIN (TouchPad)
Revskills : Menu -> Hardware Forensics -> Port Utils -> QC + AT-Cmd if you install the drivers it may show Comx - Qualcomm HS-USB QDLoader
Choose *Bootloader / Download Mode (QC)*
Choose *DWNMODE: RequestSoftVer*, click *Send Cmd* it answers that it is in PBL.
change *Load at (hex)* to *80000000* click *run Bootloader functions*, choose the *MPRG*.BIN*
And now bootloader is loaded in memory you can send commands beginning by *BOOTLDR* but it's a demo of Revskills and flash functions are disabled !
Please don't loose your time in the wrong way !


----------



## Remolten

dadwarf said:


> I don't want to be rude, my english is not enough rich to write correct sentences but i'm sure of the way to solve our problem and no one help me, why ???
> 
> We are in QDL, that's a fact, we can't quit QDL for another state that's a fact too so ... we have to use QDL !
> QDL is a Download mode, waiting for a Bootloader so ... we must send a bootloader !
> We have the bootloader, is name is emmcbld for my Pre3 it's the file MPRG7x30.HEX and for TouchPad the file (could be) MPRG8660.HEX.
> QPST can send it to the device, for REVSKILLS it needs to be converted (HEX to BIN) and to be loaded at 0x80000000 and pbl.pl (based on GobyLoader) can send it too. The device answer but the bootloader is undocumented ...
> 
> Can someone try with the TouchPad ????
> Download Revskills (Windows)
> Install QHUSB drivers (64bits)
> Donwnload MPRG7X30.BIN (Pre3) or MPRG8660.BIN (TouchPad)
> Revskills : Menu -> Hardware Forensics -> Port Utils -> QC + AT-Cmd if you install the drivers it may show Comx - Qualcomm HS-USB QDLoader
> Choose Bootloader / Download Mode (QC)
> Choose DWNMODE: RequestSoftVer, click Send Cmd it answers that it is in PBL.
> change Load at (hex) to 80000000 click run Bootloader functions, choose the MPRG*.BIN
> And now bootloader is loaded in memory you can send command beginning by BOOTLDR but it's a demo of Revskills and flash functions are disabled !
> Please don't loose your time in the wrong way !


I will try this tonight however I have a 32 bit computer so the drivers might not work.

So you're saying that if we possibly buy Revskills Pro we could send it commands?


----------



## dadwarf

Remolten said:


> I will try this tonight however I have a 32 bit computer so the drivers might not work.
> 
> So you're saying that if we possibly buy Revskills Pro we could send it commands?


There's few links on the web for 32bits drivers I found a drivers pack in RiffJtag installer and add the link ... if we buy Revskills pro we could use flash functions, but if your device answer the same thing as mine, we have to understand fist ! (few post ago i said my Pre3 wants a partition table to be sent before switching into OSBL ...)


----------



## bryantjopplin

I sent info to qualcomm to get some qpst info and whatnot. As I said b4 I can get mine to get where you are but I will try.

Sent from my Galaxy Nexus using Tapatalk 2


----------



## bryantjopplin

https://github.com/jcsullins/qdl-upload/blob/master/qdl-upload.pl

Qdl upload. It seems its experimental but something like this might help.

Sent from my Galaxy Nexus using Tapatalk 2


----------



## dadwarf

bryantjopplin said:


> https://github.com/j...r/qdl-upload.pl
> 
> Qdl upload. It seems its experimental but something like this might help.
> 
> Sent from my Galaxy Nexus using Tapatalk 2


That's also a code based on GobyLoader like pbl.pl (my previous post) the original script is used to send firmware to Goby modem.
That's the script to use to try commands after sending the bootloader.


----------



## Remolten

dadwarf said:


> That's also a code based on GobyLoader like pbl.pl (my previous post) the original script is used to send firmware to Goby modem.
> That's the script to use to try commands after sending the bootloader.


I really need those drivers as I haven't found any that work yet. Then I can go experiment with that. If we can flash it an artificial bootloader, I know there are ones that we might be able to use for recover/commands etc.


----------



## dadwarf

Remolten said:


> Where is the link???
> 
> Also that link he posted to jcsullins might have some information about the partition table in it.
> 
> I really need those drivers as I haven't found any that work yet. Then I can go experiment with that. If we can flash it an artificial bootloader, I know there are ones that we might be able to use for recover/commands etc.


Look upper i updated my post !!!


----------



## bryantjopplin

Remolten said:


> Where is the link???
> 
> Also that link he posted to jcsullins might have some information about the partition table in it.
> 
> I really need those drivers as I haven't found any that work yet. Then I can go experiment with that. If we can flash it an artificial bootloader, I know there are ones that we might be able to use for recover/commands etc.


If you can't get those to work can u use a vmware virtual box to use a 64bit machine of some sort. I'm sure there's something out there.! 

Sent from my Galaxy Nexus using Tapatalk 2


----------



## dadwarf

... Do i need to post the link each time ?

32bits / 64bits Drivers from RiffJtag


----------



## dadwarf

> [background=rgb(245, 245, 245)]Also that link he posted to jcsullins might have some information about the partition table in it.[/background]


Nop, It send magic string, request parameters and upload a file in mem and execute it ... nothing new but it's easy to modify the code to send anything else if we found some new commands !


----------



## dadwarf

It appears that the handshake in QDL is "QCOM HIGH SPEED PROTOCOL HST" and for the bootloader "QCOM FAST DOWNLOAD PROTOCOL HST" (HST for host, the device answer ... TARG for target) ... don't spend your time to look at those protocols in google : nothing !


----------



## bryantjopplin

dadwarf said:


> Nop, It send magic string, request parameters and upload a file in mem and execute it ... nothing new but it's easy to modify the code to send anything else if we found some new commands !


It's said to dump code into ram and executes from there.

Sent from my Galaxy Nexus using Tapatalk 2


----------



## dadwarf

bryantjopplin said:


> It's said to dump code into ram and executes from there.
> 
> Sent from my Galaxy Nexus using Tapatalk 2


Excuse me what is use of your answer ???
I understand Perl, i don't need you to read the comment !


----------



## bryantjopplin

dadwarf said:


> Excuse me what is use of your answer ???
> I understand Perl, i don't need you to read the comment !


I am just trying to help you when I don't even have a problem. So I don't understand your attitude. As a matter of fact jcsullins has been talking to me and he said no one's beens successful in uploading anything in qdl mode and that if your screen has a question mark on it its a problem with your battery. Hey did mention about some serial over/out the audio jack. Now since no one has been able to get jcsullins to speak and I have I would say I was helping out.

Sent from my Galaxy Nexus using Tapatalk 2


----------



## Remolten

Having trouble connecting/getting Touchpad in QDL mode as it keeps restarting over and over with Power + Home + Vol Down but I can't get it to initialize without the home button which is resetting it.

Can anyone help???


----------



## Remolten

DWNMODE: RequestSoftVer
Returns this

7E 0D 0F 50 42 4C 5F 44 6C 6F 61 64 56 45 52 
31 2E 30

~
PBL_DloadVER1
.0

Trying to load bootloader on 80000000 returns this error with MPRG8660.bin and also with boot.bin

Please wait...
Sending ping.
Uploading bootloader.
Executing init command.
Uploading.
Sending bootloader page failed : 03
Executing bootloader failed : 05

The only way I've gotten Touchpad in QDL mode "permanently" is to hold down Power + Vol Down after it first shows up in Device Manager for the extent I want to use it.


----------



## Remolten

Any ideas for finding a way to successfully booting the bootloader???


----------



## bryantjopplin

Remolten said:


> Any ideas for finding a way to successfully booting the bootloader???


I have been trying to get more info I at a wait period. Did you say you had the question mark

Sent from my Galaxy Nexus using Tapatalk 2


----------



## Remolten

bryantjopplin said:


> I have been trying to get more info I at a wait period. Did you say you had the question mark
> 
> Sent from my Galaxy Nexus using Tapatalk 2


Yes got the question mark of death.


----------



## bryantjopplin

Remolten said:


> Yes got the question mark of death.


No but the word from jcsullins us that means bad battery

Sent from my Galaxy Nexus using Tapatalk 2


----------



## Remolten

bryantjopplin said:


> No but the word from jcsullins us that means bad battery
> 
> Sent from my Galaxy Nexus using Tapatalk 2


Actually its the A6 software controller that checks if the battery exists and it is corrupted somehow because it turns on so the battery must exist lol.


----------



## bryantjopplin

Remolten said:


> Actually its the A6 software controller that checks if the battery exists and it is corrupted somehow because it turns on so the battery must exist lol.


That's what he told me. I'm no expert just relaying

Sent from my Galaxy Nexus using Tapatalk 2


----------



## Remolten

Haven't found a way yet to send the bootloader but I'll have more time over the weekend.


----------



## gk101

Remolten said:


> DWNMODE: RequestSoftVer
> Returns this
> 
> 7E 0D 0F 50 42 4C 5F 44 6C 6F 61 64 56 45 52
> 31 2E 30
> 
> ~
> PBL_DloadVER1
> .0
> 
> Trying to load bootloader on 80000000 returns this error with MPRG8660.bin and also with boot.bin
> 
> Please wait...
> Sending ping.
> Uploading bootloader.
> Executing init command.
> Uploading.
> Sending bootloader page failed : 03
> Executing bootloader failed : 05
> 
> The only way I've gotten Touchpad in QDL mode "permanently" is to hold down Power + Vol Down after it first shows up in Device Manager for the extent I want to use it.


I get the exact same RevSkills output.

BTW, a sincere thanks to you and others in this thread for pursuing solutions that don't just involve anecdotal stories about random button pushing.


----------



## Remolten

gk101 said:


> I get the exact same RevSkills output.
> 
> BTW, a sincere thanks to you and others in this thread for pursuing solutions that don't just involve anecdotal stories about random button pushing.


Thanks, basically I think we go to send it to a different address as that address is for the Pre. However, I don't know much about the Touchpad's file system so I'm not sure where we should send it.


----------



## dadwarf

Remolten said:


> Thanks, basically I think we go to send it to a different address as that address is for the Pre. However, I don't know much about the Touchpad's file system so I'm not sure where we should send it.


This address is the same for TouchPad and Pre3 in fact it's relative to QDL that allow something to be upload only from this address (0x 80 00 00 00).

You can try with QPST the log could tell you exactly what going wrong :
Download QPST, MPRG7X30.HEX, MPRG8660.HEX
Launch "Software Download", go to "Multi-image"
rename "MPRGXXXX.HEX" to "EMMCBLD.HEX"
select "Sec Boot 2.0" as "Boot system", select the folder of your HEX (it doesn't matter if you have the other files it's just to upload the bootloader)
click "Start"
go to menu "Help / Open Log File Directory", open Dload_COMx.dbg and see !


----------



## Remolten

dadwarf said:


> This address is the same for TouchPad and Pre3 in fact it's relative to QDL that allow something to be upload only from this address (0x 80 00 00 00).
> 
> You can try with QPST the log could tell you exactly what going wrong :
> Download QPST, MPRG7X30.HEX, MPRG8660.HEX
> Launch "Software Download", go to "Multi-image"
> rename "MPRGXXXX.HEX" to "EMMCBLD.HEX"
> select "Sec Boot 2.0" as "Boot system", select the folder of your HEX (it doesn't matter if you have the other files it's just to upload the bootloader)
> click "Start"
> go to menu "Help / Open Log File Directory", open Dload_COMx.dbg and see !


Okay maybe some progress examining the log file produces that QPST wants two files in the folder. The hex file called "ARMPRG.HEX" and "partition.mbn" however we don't have a partition.mbn to send it.

Here it is though (using the name ARMPRG.HEX no partition.mbn) pretty long lol:

2012/10/18 08:26:57.023 StartSB2Download
2012/10/18 08:26:57.025 Begin SB2.0 Software Download
2012/10/18 08:26:57.025 Skip Reset: 0
2012/10/18 08:26:57.025 Lock phone
2012/10/18 08:26:57.025 Examine phone mode
2012/10/18 08:26:57.025 Get partition file name
2012/10/18 08:26:57.025 Partition file (and path for flash programmer): C:\Users\athurber\Downloads\qpst\partition.mbn
2012/10/18 08:26:57.026 Flash Programmer file: C:\Users\athurber\Downloads\qpst\ARMPRG.HEX
2012/10/18 08:26:57.026 Examine phone mode
2012/10/18 08:26:57.026 Prepare to load the flash programmer
2012/10/18 08:26:57.098 Initialize the downloader
2012/10/18 08:26:57.099 Ping the downloader
2012/10/18 08:26:57.099 Sending Ping Request
2012/10/18 08:26:57.136 Response: 0x2 : Ticks: 31
2012/10/18 08:26:57.136 Wait For Download Response Succeeded.
2012/10/18 08:26:57.136 Get downloader parameters
2012/10/18 08:26:57.136 Sending Flash Programmer Parameter Request
2012/10/18 08:26:57.138 Wait For Parameter Response Succeeded.
2012/10/18 08:26:57.138 Load the flash programmer
2012/10/18 08:26:57.138 Search RAM image for erase pattern
2012/10/18 08:26:57.138 Skipped search - base address equals start address
2012/10/18 08:26:57.138 Using 32-bit write

SKIPPED ALL THE HEX WRITING AS IT IS ALMOST 1000 LINES LONG

2012/10/18 08:26:59.886 Finish switching to streaming download mode
2012/10/18 08:26:59.889 SynchronizeConnection starting...
2012/10/18 08:26:59.889 Sending Hello to flash programmer...
2012/10/18 08:27:02.891 Timeout
2012/10/18 08:27:02.891 Sending Hello to flash programmer...
2012/10/18 08:27:03.076 Qfprom Fuse List: Blowing FAILED

02012/10/18 08:27:03.076 Failed Fuse addr: 
2012/10/18 08:27:03.076 0x00000000
2012/10/18 08:27:03.076

Error Status: 
ë2012/10/18 08:27:03.076 0x00000000
2012/10/18 08:27:03.076 Disabling automatic polling.
2012/10/18 08:27:03.127 Try Hello with polling disabled...
2012/10/18 08:27:03.130 Try Hello with polling disabled...
2012/10/18 08:27:03.133 Try Hello with polling disabled...
2012/10/18 08:27:03.136 SynchronizeConnection succeeded.
2012/10/18 08:27:03.137 Sending Hello Packet
2012/10/18 08:27:03.140 Version info = 5 2
2012/10/18 08:27:03.140 Block size = 400
2012/10/18 08:27:03.140 Flash base = 0
2012/10/18 08:27:03.140 Device Name=eMMC:
2012/10/18 08:27:03.140 Flash ID size= 4
2012/10/18 08:27:03.140 Sectors = 128
2012/10/18 08:27:03.140 Feature mask = 0x09
2012/10/18 08:27:03.140 Sending Close 0
2012/10/18 08:27:03.142 Cannot close when not previously opened
2012/10/18 08:27:03.142 ARMPRG error: 15, text: Cannot close when not previously opened
2012/10/18 08:27:03.142 CloseDownloader error
2012/10/18 08:27:03.158 Sending Security Mode 0
2012/10/18 08:27:03.161 Decoding partition file
2012/10/18 08:27:04.332 Download end, status 103, error 621
2012/10/18 08:27:04.332 Exit SB 2.0 download with status 0x00000000


----------



## dadwarf

Remolten said:


> Okay maybe some progress examining the log file produces that QPST wants two files in the folder. The hex file called "ARMPRG.HEX" and "partition.mbn" however we don't have a partition.mbn to send it.
> 
> Here it is though (using the name ARMPRG.HEX no partition.mbn) pretty long lol:
> 
> 2012/10/18 08:26:57.023 StartSB2Download
> 2012/10/18 08:26:57.025 Begin SB2.0 Software Download
> 2012/10/18 08:26:57.025 Skip Reset: 0
> 2012/10/18 08:26:57.025 Lock phone
> 2012/10/18 08:26:57.025 Examine phone mode
> 2012/10/18 08:26:57.025 Get partition file name
> 2012/10/18 08:26:57.025 Partition file (and path for flash programmer): C:\Users\athurber\Downloads\qpst\partition.mbn
> 2012/10/18 08:26:57.026 Flash Programmer file: C:\Users\athurber\Downloads\qpst\ARMPRG.HEX
> 2012/10/18 08:26:57.026 Examine phone mode
> 2012/10/18 08:26:57.026 Prepare to load the flash programmer
> 2012/10/18 08:26:57.098 Initialize the downloader
> 2012/10/18 08:26:57.099 Ping the downloader
> 2012/10/18 08:26:57.099 Sending Ping Request
> 2012/10/18 08:26:57.136 Response: 0x2 : Ticks: 31
> 2012/10/18 08:26:57.136 Wait For Download Response Succeeded.
> 2012/10/18 08:26:57.136 Get downloader parameters
> 2012/10/18 08:26:57.136 Sending Flash Programmer Parameter Request
> 2012/10/18 08:26:57.138 Wait For Parameter Response Succeeded.
> 2012/10/18 08:26:57.138 Load the flash programmer
> 2012/10/18 08:26:57.138 Search RAM image for erase pattern
> 2012/10/18 08:26:57.138 Skipped search - base address equals start address
> 2012/10/18 08:26:57.138 Using 32-bit write
> 
> SKIPPED ALL THE HEX WRITING AS IT IS ALMOST 1000 LINES LONG
> 
> 2012/10/18 08:26:59.886 Finish switching to streaming download mode
> 2012/10/18 08:26:59.889 SynchronizeConnection starting...
> 2012/10/18 08:26:59.889 Sending Hello to flash programmer...
> 2012/10/18 08:27:02.891 Timeout
> 2012/10/18 08:27:02.891 Sending Hello to flash programmer...
> 2012/10/18 08:27:03.076 Qfprom Fuse List: Blowing FAILED
> 
> 02012/10/18 08:27:03.076 Failed Fuse addr:
> 2012/10/18 08:27:03.076 0x00000000
> 2012/10/18 08:27:03.076
> 
> Error Status:
> ë2012/10/18 08:27:03.076 0x00000000
> 2012/10/18 08:27:03.076 Disabling automatic polling.
> 2012/10/18 08:27:03.127 Try Hello with polling disabled...
> 2012/10/18 08:27:03.130 Try Hello with polling disabled...
> 2012/10/18 08:27:03.133 Try Hello with polling disabled...
> 2012/10/18 08:27:03.136 SynchronizeConnection succeeded.
> 2012/10/18 08:27:03.137 Sending Hello Packet
> 2012/10/18 08:27:03.140 Version info = 5 2
> 2012/10/18 08:27:03.140 Block size = 400
> 2012/10/18 08:27:03.140 Flash base = 0
> 2012/10/18 08:27:03.140 Device Name=eMMC:
> 2012/10/18 08:27:03.140 Flash ID size= 4
> 2012/10/18 08:27:03.140 Sectors = 128
> 2012/10/18 08:27:03.140 Feature mask = 0x09
> 2012/10/18 08:27:03.140 Sending Close 0
> 2012/10/18 08:27:03.142 Cannot close when not previously opened
> 2012/10/18 08:27:03.142 ARMPRG error: 15, text: Cannot close when not previously opened
> 2012/10/18 08:27:03.142 CloseDownloader error
> 2012/10/18 08:27:03.158 Sending Security Mode 0
> 2012/10/18 08:27:03.161 Decoding partition file
> 2012/10/18 08:27:04.332 Download end, status 103, error 621
> 2012/10/18 08:27:04.332 Exit SB 2.0 download with status 0x00000000


You're right if you don't check "use download mode only" it looks for a different name for the same file.

You must create your own partition.mbn, i found the structure in websdoctor a file name topaz.xml this could help you to build a MBR sector (partition.mbn is a dump of the 512 bytes of the MBR). I could make it for you later if you want ...

That's great it seems that your device reaction is different than mine (for me it doesn't works) if you find dbl.mbn, osbl.mbn (and amss.mbn if you have GSM functions) you could be able to flash it with QPST ... this files are compiled in one file in webOS.tar in webosdoctor ...


----------



## Remolten

dadwarf said:


> You're right if you don't check "use download mode only" it looks for a different name for the same file.
> 
> You must create your own partition.mbn, i found the structure in websdoctor a file name topaz.xml this could help you to build a MBR sector (partition.mbn is a dump of the 512 bytes of the MBR). I could make it for you later if you want ...
> 
> That's great it seems that your device reaction is different than mine (for me it doesn't works) if you find dbl.mbn, osbl.mbn (and amss.mbn if you have GSM functions) you could be able to flash it with QPST ... this files are compiled in one file in webOS.tar in webosdoctor ...


Did you check the log to see what file it wants???

If you could assemble it that would be great also as I don't know about the structure of those files.

Also what file are they located the mbns located in specifically?

Let's join up on webchat.freenode.net channel:
qpst

At 10 central time.


----------



## dadwarf

Remolten said:


> Did you check the log to see what file it wants???
> 
> If you could assemble it that would be great also as I don't know about the structure of those files.
> 
> Also what file are they located the mbns located in specifically?


The lines of downloading you skip tells the address in RAM for Revskills.
At this step even if QPST complains about lack of file, your bootloader is loaded.
You can close QPST and open Revskills to test BOOTLDR functions !
That's not the log that tells me the files needed thats the structure of your device (topaz.xml).
I'll download again your webosdoctor to post it ...
i don't understand your last sentences (my english is poor)


----------



## Remolten

dadwarf said:


> The lines of downloading you skip tells the address in RAM for Revskills.
> At this step even if QPST complains about lack of file, your bootloader is loaded.
> You can close QPST and open Revskills to test BOOTLDR functions !
> That's not the log that tells me the files needed thats the structure of your device (topaz.xml).
> i don't understand your last sentences (my english is poor)


Go to in the web browser

webchat.freenode.net

Type in a nickname and type in "qpst" without quotes for the channel.

Then fill in captcha and connect so we can chat.


----------



## Remolten

Most of the commands for the revskills give errors however some work so we know that I got it booted in an artificial bootloader.


----------



## Remolten

We need to find a way to send the Touchpad commands because we are in a bootloader now.


----------



## dadwarf

Remolten said:


> We need to find a way to send the Touchpad commands because we are in a bootloader now.


 As i said the protocol of the bootloader is "QCOM Fast Download Protocol". Commands are unknown if we aren't Qualcomm's developers !


----------



## tolookah

I've been watching this thread, hoping for a breakthrough. I've tried a few attempts to get any data on the snapdragon, so far no luck, though. My Touchpad, like others, is stuck in QDL Mode (no button combinations get me out of it) If I get anywhere, I'll let you know, otherwise, I hope you guys get somewhere (as I am getting nowhere)


----------



## Remolten

Okay I've been gone the last few days any breakthroughs?


----------



## Remolten

dadwarf said:


> As i said the protocol of the bootloader is "QCOM Fast Download Protocol". Commands are unknown if we aren't Qualcomm's developers !


http://www.scribd.com/doc/99135741/80-39912-1-Rev-a-DMSS-Download-Protocol

This looks pretty similiar to revskills however I'm not totally sure how we'd run it.

If we could find where that battery check is located on the flash we could erase and write to it replacement code so it would boot.

And in your case you could probably just send the reset command if your phone is just stuck in QDL mode.


----------



## Remolten

Anyone had any progress?

Haven't had a chance to do anything yet but the weekend is coming


----------



## freecicero

AndroidLover, good luck and best wishes!

There is at least one of us here following this thread closely and who wants more use out of his touchpad than a paperweight!!!


----------



## dadwarf

Remolten said:


> http://www.scribd.co...wnload-Protocol
> This looks pretty similiar to revskills however I'm not totally sure how we'd run it


That's a great document, but it confirms that we can't do anything in download Mode except uploading a piece of code to do something !
There's no write function on eMMC only in (a portion of) memory. If you found the same document about our bootloader (emmcbld) that would be nice !


> If we could find where that battery check is located on the flash we could erase and write to it replacement code so it would boot.


Sorry this is not Zelda we can't think re-flash of an eMMC as it 


> And in your case you could probably just send the reset command if your phone is just stuck in QDL mode.


Mmmh i think we have answer to this question a lot of times ! it's stuck in QDL because it can't boot because of a corruption of a part (or whole) eMMC !

I think it's time to give up and sell that non working device as it !


----------



## Remolten

dadwarf said:


> I think it's time to give up and sell that non working device as it !


That I definitely don't want to do. However, it's looking like that's the case. I still haven't got a chance to do much, but I will stake my last tries over the weekend.


----------



## dadwarf

I don't want nether but i'm aware that nobody really make research ! We only try to reproduce what had already been done we need someone that could go furtherer !
Here is the structure of the TouchPad : topaz.xml, the partition.mbn (MBR 512 bytes). But it's useless because i doesn't take care of the extended partitions not located in MBR ...

There is an interesting point about bootie, WebOS Internals says it's a part of boot.bin (topaz-boot.bin) but no longer gziped (because they are talking about Pre, Pre2 and Pixi). bootie is loaded in memory (at 0x82000000), could we execute directly without going through first stage (?) and second stage (boot.bin) boot ?
I think we can't but ... ... so we have to find where begin bootie in boot.bin !

Nope in Pre3 and TouchPad boot.bin is exactly what it is gzipped at the end of boot.bin of a Pre, Pre2 and Pixi ... so boot.bin is bootie ... Wrong way !


----------



## fgdn17

mattv said:


> @TunG19 -- thanks much for your efforts!
> 
> Not sure if this is going to work. I Got my hands on another touchpad and booted it into loader mode to try this --- when i went to do the download, QPST said the device was in "download" mode rather than "diagnostics" mode and wouldn't pull the image, same as your experience
> 
> My touchpad might be dead and out for the count. Frustrating.


you said that in your first post and didn't even realize it...when you said

"QPST. It's made for reading/writing to phones."
LOL


----------



## Remolten

Okay finally have got some progress.

From the webosdoctor.jar I've pulled a boot-topaz.bin and a regular boot.bin.

Also under boot in the Touchpad's filesystem, I looked in the boot-genesis archive and found these 6 .mbn files that we might be able to use to finish flashing the bootloader.

I'll be trying it as soon as I get the chance.


----------



## gk101

Any chance that the work done in this thread could be of help here since we are able to get the TPs into Qloader mode?
http://forum.xda-developers.com/showthread.php?t=1914359&page=9


----------



## Remolten

gk101 said:


> Any chance that the work done in this thread could be of help here since we are able to get the TPs into Qloader mode?
> http://forum.xda-dev...=1914359&page=9


It looks promising. I'll look at it more tonight.

I didn't have any luck with anything I tried however I suspect it was just RevSkills/QPST acting up for some reason.

What I've got so far is just flashing the Touchpad a bootloader. I have no idea of the partition files I send it work though.


----------



## ry1114

I have the same problem, has anyone tried to charge with touchstone to see if it charges.


----------



## Remolten

ry1114 said:


> I have the same problem, has anyone tried to charge with touchstone to see if it charges.


No one that I know of has tried that however it might work for those of you who just have a Touchpad that doesn't turn on/stuck in QDL.

Oh yeah, and if anyone has a Touchpad/other device stuck in QDL mode I think I know how to get you out.


----------



## tolookah

Remolten said:


> No one that I know of has tried that however it might work for those of you who just have a Touchpad that doesn't turn on/stuck in QDL.
> 
> Oh yeah, and if anyone has a Touchpad/other device stuck in QDL mode I think I know how to get you out.


On the touchstone, it doesnt help qdl mode (ive tried)

As for a fix, i am more than interested.


----------



## Remolten

tolookah said:


> On the touchstone, it doesnt help qdl mode (ive tried)
> 
> As for a fix, i am more than interested.


So what is your problem exactly? Is the Touchpad dead? Is it stuck in QDL mode? Or what is the deal cuz we need to know that first.


----------



## ddog511

I also have this problem, the touchpad shows as unresponsive, but when I connected it to my computer I get the driver install prompt for qhsusb_dload. So if this is in the right state for the fix, I'd love to try it out.

Thanks


----------



## tolookah

I'm stuck in qdl mode.


----------



## Remolten

ddog511 said:


> That's great as I believe that is fixable right now. However you will have to be patient as we might have to go through this stuff a few times.
> 
> I'm stuck in qdl mode.


Same as above we should be able to revive these.

Here we go...
So anyways, if you haven't read the thread, you might as well do that first.
If you don't have a file manager besides the stock Windows Explorer download one (I recommend WinRAR)
Download and install these drivers: 
http://www.mediafire...9oz439ywnwfhc6i
Download and install QPST: 
http://www.mediafire...odgqoomaoot0pdc
Download and install revskills (might not need but do it anyways): 
http://www.mediafire...v00l39ssq489w17
If you don't have the webOS Doctor JAR Download here: 
http://downloads.hel...05hstnhwifi.jar
Okay that's all for tonight I'm kinda worn out. Just get all that stuff installed I will probably post the rest of the instructions tomorrow morning.


----------



## tolookah

Got all that. I'll be able to try any next steps tomorrow afternoon. Thanks for hope!


----------



## ddog511

I get an 'install failed' message when trying to install the driver file. Any thoughts? Using Win7 x32.

Thanks.

Edit - Never mind, I figured out what I was doing wrong...all set to go and looking forward to this.

Thanks


----------



## Remolten

tolookah said:


> I get an 'install failed' message when trying to install the driver file. Any thoughts? Using Win7 x32.
> 
> Thanks.
> 
> Edit - Never mind, I figured out what I was doing wrong...all set to go and looking forward to this.
> 
> Thanks


Glad you figured it out.

Okay here we continue...

But first you will need these files too:
http://www.mediafire.com/?jtsxnpdshjz6ew7

Open up Windows Device Manager (type in "device manager" without quotes in the start menu)
Connect Touchpad to computer while it's in QDL mode
In Device Manager, if it's properly connected, there will be an option called Ports, expand this
Your Touchpad should show up as COM* Qualcomm DLoader 9008 (or something close to that [and also note the number after com {denoted with asterisk} doesn't matter])
If the Touchpad is properly connected, close Device Manager
Go under All Programs in your Start Menu folder, and find the QPST folder and expand it
Choose QPST Configuration and Open it
Click add new Port then select and use the Port that your Touchpad is on
Go to Start Clients--Software Download at the top options in QPST
Switch to the Multi Image tab
It will probably display an error just click ok
Under Image Folder click Browse and locate the QPST BL folder that you downloaded (make sure you extract it first)
Leave the SPC Option at Default
Under Please select Sec Boot 2.0
Keep Use Emerg. Host D/L and Trusted Mode Unchecked
Make sure Auto Backup/Restore is Checked
Click Start
QPST will error with something like no partition file after a bit which is okay
Go to at the top, Help--Open Log File Directory
It will open in Windows Explorer, upload to a file sharing website (or whatever) Dload_COM*.dbg for me so I can see it
Now your Touchpad should be stuck in a different bootloader then QDL
The next steps will take some patience as it is often hard to jar the Touchpad out of this bootloader we flashed it
Try different button combinations to try to reset/wake the Touchpad
If all goes well once you get it disengaged from the bootloader, it should boot normally.
If it doesn't work and when you plug it in to the computer it shows up as the same again, just wait for future instructions tonight.
Lots of steps! Hopefully this works for you guys!


----------



## dadwarf

Remolten, focus on why did it complain about lack of partition table, the process to restore your TouchPad is well described in the thread pointed by gk101.


----------



## Remolten

dadwarf said:


> Remolten, focus on why did it complain about lack of partition table, the process to restore your TouchPad is well described in the thread pointed by gk101.


You're probably right haven't had much time so I haven't read the whole thread yet.

I will try to do this tonight as it looks very very promising for me.


----------



## dadwarf

Remolten said:


> You're probably right haven't had much time so I haven't read the whole thread yet.
> 
> I will try to do this tonight as it looks very very promising for me.


 I have a bad news for you, if you had follow our thread, there is no surprise : it will also missing a partition table to be sent !

I had explored this method few month ago ...

The method is to send the bootloader (MPRG8660.HEX) with emmcdownload in order to flash a structure of the eMMC to be able to switch to a mode that makes the device shown as a SD card in USB (and after flashing back each partitions) ... but after sending the bootloader the error still the same ! that could be specific to our device because i never read something about it and a lot of sites talk about this method of recovery !


----------



## tolookah

Mine failed for missing a few hex files...


Code:


<br />
2012/11/13 16:57:59.265 StartSB2Download<br />
2012/11/13 16:57:59.267 Begin SB2.0 Software Download<br />
2012/11/13 16:57:59.267 Skip Reset: 0<br />
2012/11/13 16:57:59.267 Lock phone<br />
2012/11/13 16:57:59.267 Examine phone mode<br />
2012/11/13 16:57:59.267 Get partition file name<br />
2012/11/13 16:57:59.267 Partition file (and path for flash programmer): C:\Users\alexis\Documents\ touchpad hex files\partition.mbn<br />
2012/11/13 16:57:59.268 Flash Programmer file: C:\Users\alexis\Documents\ touchpad hex files\NPRG7525.HEX<br />
2012/11/13 16:57:59.269 Examine phone mode<br />
2012/11/13 16:57:59.269 Prepare to load the flash programmer<br />
2012/11/13 16:57:59.269 ERROR: Error opening flashprg file.<br />
2012/11/13 16:57:59.269 MILoadFlashprg: fopen() returned NULL for ARM file C:\Users\alexis\Documents\ touchpad hex files\NPRG7525.HEX<br />
2012/11/13 16:58:00.577 Download end, status 103, error 111<br />
2012/11/13 16:58:00.577 Exit SB 2.0 download with status 0x00000000<br />

Touchpad didn't re-boot into anything, still in qdl mode


----------



## ddog511

Here is my log file... Also, I could not get it out of download mode


----------



## Remolten

tolookah said:


> I have a bad news for you, if you had follow our thread, there is no surprise : it will also missing a partition table to be sent !
> 
> I had explored this method few month ago ...
> 
> The method is to send the bootloader (MPRG8660.HEX) with emmcdownload in order to flash a structure of the eMMC to be able to switch to a mode that makes the device shown as a SD card in USB (and after flashing back each partitions) ... but after sending the bootloader the error still the same ! that could be specific to our device because i never read something about it and a lot of sites talk about this method of recovery !


Read the thread through and I will be trying the steps out. For me though, I'm not sure I how any of these steps can help me. As my Touchpad is actually fully functional but the webOS initial Touchpad booting items think that the battery is nonexistent so the only way it is fixable is editing/deleting the file that controls this. However, it probably isn't available from the normal sd card mount. But I'll continue trying stuff even if it doesn't work for me.

I feel we are reaching the end.....either we're gonna figure this out, or we'll reach the end of the line. I'll try to compile some instructions from that thread tomorrow, however it probably won't be done until Thursday so hold tight.


----------



## ddog511

That is correct. It is still unresponsive and shows up as in qdl mode.

As for tolookah, I wonder - one thing I noticed is that he has a space in the name of the folder "c:\Users\Alexis\Documents\ touchpad hex files\" ... perhaps the program doesn't like the space before the name...just a thought.
Thanks for all of your work on this. It would be wonderful to get this back up and running.
I've been trying to get it repaired by HP, but they haven't answered any of my emails after the initial one where they asked me for my proof of purchase, which I provided.


----------



## tolookah

Alright, so it seems QPST Software remembers settings from previous sessions, (I was trying things with different names).

I tried it on another machine, and got similar results as ddog11, same error codes and everything. It comes back up as qdloader device after this.

(and the / t in the block of text up there was actually me editing it afterwards, it kept changing /t (slash t) into a tab).

In the webos jar, there are a bunch of files that the qpst software can take, but I have had no luck loading any of them so far. I've tried both the qualcomm software and jcsullins' perl scripts, and this is the closest it's looked to responding, so I think you're on the right path. (it does restart the device)


----------



## dadwarf

> [background=rgb(245, 245, 245)]I'll try to compile some instructions[/background]


 Like a magic potion ?

In fact if you could mount whole partitions (by switching in mmc mode) you'll be able to edit whole contents.
Battery is managed by bootie (boot.bin or boot-topaz.bin they are the same) if you want to know.


----------



## Remolten

dadwarf said:


> Like a magic potion ?
> 
> In fact if you could mount whole partitions (by switching in mmc mode) you'll be able to edit whole contents.
> Battery is managed by bootie (boot.bin or boot-topaz.bin they are the same) if you want to know.


That's what I'm hoping however it appears from what I seen that it is on the integrated flash storage which is untouchable.

By any chance do know a program that can edit bin files? Haven't been able to find one.


----------



## dadwarf

Remolten said:


> That's what I'm hoping however it appears from what I seen that it is on the integrated flash storage which is untouchable.
> 
> By any chance do know a program that can edit bin files? Haven't been able to find one.


You are wrong the integrated storage (eMMC) is not untouchable, what do you mean by untouchable ??? 
You haven't found a decompiler ? If you are looking for a good one : IDA for Windows.

But i guess you aren't going to learn assembler or C just to unbrick our devices


----------



## ph3d

Hi I have a touchpad that won't power on only time it shows life is when I connect it to the PC and hold power home and volume up it shows up sometimes as USB qualcom ldr most times just a palm device I have tried charging it for a full week with a mains charged USB.charged and a touchstone all a week each with no luck.. I also have a working one which I am using right now any advice on steps to try?


----------



## Remolten

dadwarf said:


> Hi I have a touchpad that won't power on only time it shows life is when I connect it to the PC and hold power home and volume up it shows up sometimes as USB qualcom ldr most times just a palm device I have tried charging it for a full week with a mains charged USB.charged and a touchstone all a week each with no luck.. I also have a working one which I am using right now any advice on steps to try?


Go to page 16 of this thread and follow those instructions I posted.

They are definitely worth a try.


----------



## dadwarf

> [background=rgb(245, 245, 245)]That is so ironic as I do program and have programmed my own game.[/background]


Could you tell me what language you use to code ?


----------



## ph3d

Code:


<br />
2012/11/15 11:02:28.777 StartSB2Download<br />
2012/11/15 11:02:28.792 Begin SB2.0 Software Download<br />
2012/11/15 11:02:28.792 Skip Reset: 0<br />
2012/11/15 11:02:28.792 Lock phone<br />
2012/11/15 11:02:28.792 Examine phone mode<br />
2012/11/15 11:02:28.792 Get partition file name<br />
2012/11/15 11:02:28.792 Partition file (and path for flash programmer): C:\Documents and Settings\********\Desktop\QPST-Unbrick\documents-export-2012-11-15\QPST BL\partition.mbn<br />
2012/11/15 11:02:28.792 Flash Programmer file: C:\Documents and Settings\**********\Desktop\QPST-Unbrick\documents-export-2012-11-15\QPST BL\ARMPRG.HEX<br />
2012/11/15 11:02:28.792 Examine phone mode<br />
2012/11/15 11:02:28.792 Prepare to load the flash programmer<br />
2012/11/15 11:02:28.886 Initialize the downloader<br />
2012/11/15 11:02:28.902 Ping the downloader<br />
2012/11/15 11:02:28.902 Sending Ping Request<br />
2012/11/15 11:02:28.902 Response: 0x2 : Ticks: 0<br />
2012/11/15 11:02:28.902 Wait For Download Response Succeeded.<br />
2012/11/15 11:02:28.902 Get downloader parameters<br />
2012/11/15 11:02:28.902 Sending Flash Programmer Parameter Request<br />
2012/11/15 11:02:28.902 Wait For Parameter Response Succeeded.<br />
2012/11/15 11:02:28.902 Load the flash programmer<br />
2012/11/15 11:02:28.902 Search RAM image for erase pattern<br />
2012/11/15 11:02:28.902 Skipped search - base address equals start address<br />
2012/11/15 11:02:28.902 Using 32-bit write<br />
2012/11/15 11:02:28.902 Sent Write: Address: 0x2A000000 Size: 0x100<br />
<br />
.......................................................Lots Of Write Address Ommited..............................................................<br />
<br />
2012/11/15 11:02:30.073 Wait For Download Response Succeeded.<br />
2012/11/15 11:02:30.073 Sent Write: Address: 0x2A028600 Size: 0x100<br />
2012/11/15 11:02:30.073 Response: 0x2 : Ticks: 0<br />
2012/11/15 11:02:30.073 Wait For Download Response Succeeded.<br />
2012/11/15 11:02:30.073 Sent Write: Address: 0x2A028700 Size: 0x100<br />
2012/11/15 11:02:30.073 Response: 0x2 : Ticks: 0<br />
2012/11/15 11:02:30.073 Wait For Download Response Succeeded.<br />
2012/11/15 11:02:30.073 Sent Write: Address: 0x2A028800 Size: 0x84<br />
2012/11/15 11:02:30.073 Response: 0x2 : Ticks: 0<br />
2012/11/15 11:02:30.073 Wait For Download Response Succeeded.<br />
2012/11/15 11:02:30.073 Sending Go Command 0x2A000000<br />
2012/11/15 11:02:30.214 Response: 0x2 : Ticks: 141<br />
2012/11/15 11:02:30.214 Wait For Download Response Succeeded.<br />
2012/11/15 11:02:30.214 Finish switching to streaming download mode<br />
2012/11/15 11:02:30.214 SynchronizeConnection starting...<br />
2012/11/15 11:02:30.214 Sending Hello to flash programmer...<br />
2012/11/15 11:02:33.214 Timeout<br />
2012/11/15 11:02:33.214 Sending Hello to flash programmer...<br />
2012/11/15 11:02:33.480 Disabling automatic polling.<br />
2012/11/15 11:02:33.480 Qfprom Fuse List: Blowing FAILED<br />
„2012/11/15 11:02:33.480 Failed Fuse addr:<br />
l2012/11/15 11:02:33.480 0x00000000<br />
2012/11/15 11:02:33.480<br />
Error Status:<br />
2012/11/15 11:02:33.480 0x00000000<br />
a2012/11/15 11:02:33.542 Try Hello with polling disabled...<br />
2012/11/15 11:02:33.542 Try Hello with polling disabled...<br />
2012/11/15 11:02:33.542 Try Hello with polling disabled...<br />
2012/11/15 11:02:33.542 SynchronizeConnection succeeded.<br />
2012/11/15 11:02:33.542 Sending Hello Packet<br />
2012/11/15 11:02:33.542 Version info = 5 2<br />
2012/11/15 11:02:33.542 Block size = 400<br />
2012/11/15 11:02:33.542 Flash base = 0<br />
2012/11/15 11:02:33.542 Device Name=eMMC:<br />
2012/11/15 11:02:33.542 Flash ID size= 4<br />
2012/11/15 11:02:33.542 Sectors = 128<br />
2012/11/15 11:02:33.542 Feature mask = 0x09<br />
2012/11/15 11:02:33.542 Sending Close 0<br />
2012/11/15 11:02:33.542 Cannot close when not previously opened<br />
2012/11/15 11:02:33.542 ARMPRG error: 15, text: Cannot close when not previously opened<br />
2012/11/15 11:02:33.542 CloseDownloader error<br />
2012/11/15 11:02:33.542 Sending Security Mode 0<br />
2012/11/15 11:02:33.558 Decoding partition file<br />
2012/11/15 11:02:34.261 Download end, status 103, error 621<br />
2012/11/15 11:02:34.261 Exit SB 2.0 download with status 0x00000000


----------



## ph3d

Still shows up as Qualcomm HS-USB QDLOADER 9008 with Power + Volume Down

If I power on with Power + Volume Up + Home it still shows as a Palm Device and cant install any drivers.


----------



## ph3d

Is the error not related to 0x00000000 is it worth changing this to 0x80000000 as was mentioned earlier in the thread?


----------



## sieve wang

ph3d said:


> Still shows up as Qualcomm HS-USB QDLOADER 9008 with Power + Volume Down
> 
> If I power on with Power + Volume Up + Home it still shows as a Palm Device and cant install any drivers.


[background=rgb(247, 247, 247)]Please measure[/background][background=rgb(247, 247, 247)] the voltage of the battery[/background]


----------



## ph3d

Also looking through QPST is there not any way for us to retrieve the FactoryImage2.mbn for our device and try to restore a image that way or does one not exist for the touchpad?


----------



## sieve wang

Remolten said:


> Okay basically looks like you used either the wrong hex file or you renamed it.
> 
> The only way that it will work is if it is named ARMPRG.hex nothing else.
> 
> Good! That's basically what we wanted to happen. Your Touchpad is totally non-responsive correct?
> 
> When you plug into the computer did it show up as QDL mode again?
> 
> Read the thread through and I will be trying the steps out. For me though, I'm not sure I how any of these steps can help me. As my Touchpad is actually fully functional but the webOS initial Touchpad booting items think that the battery is nonexistent so the only way it is fixable is editing/deleting the file that controls this. However, it probably isn't available from the normal sd card mount. But I'll continue trying stuff even if it doesn't work for me.
> 
> I feel we are reaching the end.....either we're gonna figure this out, or we'll reach the end of the line. I'll try to compile some instructions from that thread tomorrow, however it probably won't be done until Thursday so hold tight.


 I didn't rename it ,but it also say:ERROR: Error opening flashprg file.


----------



## ph3d

Tried with 0x80000000 address was the same just to let people know - just bored and trying stuff I dont really have a clue what I am doing here to be honest although I am well experienced with networks/linux my programming skills are virtually non existant - only basic scripting/c


----------



## Remolten

dadwarf said:


> Tried with 0x80000000 address was the same just to let people know - just bored and trying stuff I dont really have a clue what I am doing here to be honest although I am well experienced with networks/linux my programming skills are virtually non existant - only basic scripting/c


It's worth a try but it probably won't make much of a difference.

If you guys check out the JTAG thread, I've asked the person doing it if they would help us recover our Touchpads. They have agreed and we are in the process of trying to figure this out.


----------



## ph3d

Remolten,

Excellent work getting darkspr1te to help I have posted on the other thread if you guys need anything just let me know.

Cheers!!


----------



## sieve wang

Remolten said:


> Why?


[background=yellow]When the voltage of my battery[/background][background=rgb(247, 247, 247)] is less than 3.4V,my touchpad is like this:Power + Volume Up + Home =a palm device,power+[/background][background=rgb(247, 247, 247)]Volume Down=[/background][background=rgb(247, 247, 247)]Qualcomm HS-USB QDLOADER 9008,you know that [/background][background=rgb(247, 247, 247)]Only when the [/background][background=rgb(247, 247, 247)] voltage is higher than [/background][background=rgb(247, 247, 247)]3.7V ，then touchpad can start[/background][/font]


----------



## ph3d

sieve wang said:


> [background=yellow]When the voltage of my battery[/background][background=rgb(247,247,247)] is less than 3.4V,my touchpad is like this:Power + Volume Up + Home =a palm device,power+[/background][background=rgb(247,247,247)]Volume Down=[/background][background=rgb(247,247,247)]Qualcomm HS-USB QDLOADER 9008,you know that [/background][background=rgb(247,247,247)]Only when the [/background][background=rgb(247,247,247)]voltage is higher than [/background][background=rgb(247,247,247)]3.7V ，then touchpad can start[/background][/font]


There is reports of the batterys being replaced and they still do not boot and stay stuck in this mode.


----------



## dadwarf

When you are in QDL mode the battery won't charge because PBL doesn't manage it.
3.4v is enough to power the TouchPad but not enough for bootie that disable boot.
I think some TouchPad have bad battery some other bad eMMC, no ?


----------



## Remolten

ph3d said:


> When you are in QDL mode the battery won't charge because PBL doesn't manage it.
> 3.4v is enough to power the TouchPad but not enough for bootie that disable boot.
> I think some TouchPad have bad battery some other bad eMMC, no ?


I can confirm that you can't charge in QDL mode however you can charge when the Touchpad is off.

I've posted the files darkspr1te needs so hopefully some people can get their devices working again.


----------



## dadwarf

This guy managed to switch is TouchPad in mmc mode with the explanation of darkspr1te !


----------



## Remolten

dadwarf said:


> This guy managed to switch is TouchPad in mmc mode with the explanation of darkspr1te !


Hope for you guys but I don't know about me.

Mine might be a little more complicated but I think we have a good chance of figuring it out.


----------



## ddog511

I'm trying to figure out what I missed... is there another thread I should be reading for help with getting my Touchpad out of qdl mode?


----------



## ph3d

http://forum.xda-developers.com/showthread.php?t=1914359&page=13


----------



## ddog511

Thanks for the link. I'm heading up north for the next few days, so I'll catch up when I get back into town.... and internet access lol.


----------



## jcsullins

dadwarf said:


> This guy managed to switch is TouchPad in mmc mode with the explanation of darkspr1te !


The guy in that thread was working on a Touchpad Go (a pretty rare beast).

However, I JUST CONFIRMED THAT THE METHOD DOES WORK for "regular" Touchpads (on my 32G TP).

That is, of course, if it's just data corruption on the emmc (i.e. bootloaders, etc.) and not
the emmc or other hardware itself that is faulty.

I'm now looking into the details of what needs to be written back to emmc for recovery (short of a big 500M chunk of data).

Note that there is an area on the emmc that contains some device specific data (serial number, sensor calibration data, etc.)
that should be preserved if possible. So that should be taken into account for any recovery process.

More soon ...


----------



## ph3d

Wow we have the god of touchpads here to help! Looking forward to the more soon! Thanks for helping jcsullins


----------



## dadwarf

jcsullins said:


> The guy in that thread was working on a Touchpad Go (a pretty rare beast).
> 
> However, I JUST CONFIRMED THAT THE METHOD DOES WORK for "regular" Touchpads (on my 32G TP).
> 
> That is, of course, if it's just data corruption on the emmc (i.e. bootloaders, etc.) and not
> the emmc or other hardware itself that is faulty.
> 
> I'm now looking into the details of what needs to be written back to emmc for recovery (short of a big 500M chunk of data).
> 
> Note that there is an area on the emmc that contains some device specific data (serial number, sensor calibration data, etc.)
> that should be preserved if possible. So that should be taken into account for any recovery process.
> 
> More soon ...


Do you have an idea about the answer of our devices ?

emmcdownload log :


> 2012/11/15 15:43:16.379 Opening eMMC USER file
> 2012/11/15 15:43:16.380 Opening eMMC USER mode
> 2012/11/15 15:43:16.380 Sending MI Open mode 33 size 0
> 2012/11/15 15:43:16.382 No partition table received before open multi
> •2012/11/15 15:43:16.383 ARMPRG error: 15, text: No partition table received before open multi
> 2012/11/15 15:43:16.385 Download end, status 103, error 852
> 2012/11/15 15:43:16.385 Exit SB 2.0 download with status 0x00000000


Do you think we spend our time for nothing our eMMC are dead ?


----------



## unbrick

hey guys,

havin exactly the same problem with a bricked huawei u8860, (only bootloader (osbl.mbn) is corrupted).
when i connect the device to pc it is recognized on com3 and with qpst in download mode but when
i try to flash files using multiimage it says "Could Not Open Flash Programming File" so i think i have not the right hex file.
my processor is: Qualcomm MSM8255T Snapdragon
and here the log:
2012/11/17 14:07:53.226 StartSB2Download
2012/11/17 14:07:53.228 Begin SB2.0 Software Download
2012/11/17 14:07:53.228 Skip Reset: 0
2012/11/17 14:07:53.228 Lock phone
2012/11/17 14:07:53.228 Examine phone mode
2012/11/17 14:07:53.228 Get partition file name
2012/11/17 14:07:53.229 Partition file (and path for flash programmer): C:\Users\-\Desktop\partition.mbn
2012/11/17 14:07:53.229 Flash Programmer file: C:\Users\-\Desktop\NPRG7X30.HEX
2012/11/17 14:07:53.230 Examine phone mode
2012/11/17 14:07:53.230 Prepare to load the flash programmer
2012/11/17 14:07:53.231 ERROR: Error opening flashprg file.
2012/11/17 14:07:53.231 MILoadFlashprg: fopen() returned NULL for ARM file C:\Users\-\Desktop\NPRG7X30.HEX
2012/11/17 14:07:53.239 Download end, status 103, error 111
2012/11/17 14:07:53.239 Exit SB 2.0 download with status 0x00000000

(I have no partition.mbn but osbl and dbl and the others i have from backup.)

another point i wanted to mention is that when i start my phone it comes the huawei logo and than just blue or pink screen
it depends which buttons i press but because of coruppted bootloader the color has no meaning anymore.
But now the more interesting point:
when i start the program MemoryDebugApp.exe and press the button in right corner a big green OK appears on my mobile screen.
does anyone nows what it means? (when you scroll over the button it says: press this button to reboot the phone in diagnstic mode
and also the icon of this programm has an OK in it.

thanks for your answers


----------



## sieve wang

<?xml version="1.0" encoding="UTF-8" ?>
- 

- <TrenchCoat>

<CPU type="*MSM8660*" />

- <Flash type="*mmc*" alignment="*1*" reusePartitions="*true*" device="*/dev/mmcblk0*">

<Entry type="*space*" size="*512*" align="*false*" reformat="*false*" />

<Entry type="*space*" partition="*0xc*" size="*1024KB*" reformat="*false*" />
- 

<Entry type="*space*" partition="*0x4d*" size="*500KB*" reformat="*false*" />
- 

<Entry type="*space*" partition="*0x51*" size="*1500KB*" reformat="*false*" />
- 
- 

<Entry type="*space*" partition="*0x47*" size="*500KB*" reformat="*false*" />
- 

<Entry type="*space*" partition="*0x45*" size="*500KB*" reformat="*false*" />
- 

<Entry type="*space*" partition="*0x4c*" size="*2500KB*" reformat="*false*" />
- 

<Entry type="*space*" partition="*0x48*" size="*10240KB*" reformat="*false*" />
- 

<Entry type="*space*" partition="*0x46*" size="*1500KB*" reformat="*false*" />
- 

<Entry type="*space*" partition="*0x4a*" size="*3072KB*" reformat="*false*" />
- 

<Entry type="*space*" partition="*0x4b*" size="*3072KB*" reformat="*false*" optional="*true*" />
- 
- 

- <Entry type="*nvram*" size="*4MB*">

- 

</Entry>
</Flash>
</TrenchCoat>

webosdoctor


----------



## Remolten

jcsullins said:


> The guy in that thread was working on a Touchpad Go (a pretty rare beast).
> 
> However, I JUST CONFIRMED THAT THE METHOD DOES WORK for "regular" Touchpads (on my 32G TP).
> 
> That is, of course, if it's just data corruption on the emmc (i.e. bootloaders, etc.) and not
> the emmc or other hardware itself that is faulty.
> 
> I'm now looking into the details of what needs to be written back to emmc for recovery (short of a big 500M chunk of data).
> 
> Note that there is an area on the emmc that contains some device specific data (serial number, sensor calibration data, etc.)
> that should be preserved if possible. So that should be taken into account for any recovery process.
> 
> More soon ...


So I'm guessing this means the question mark of death will still be unfixable.


----------



## bryantjopplin

Remolten said:


> So I'm guessing this means the question mark of death will still be unfixable.


From reading everything yes as long as your hardware is good. And this darkspr1te guy, Wtf, where has he been. He is a genius. To bad someone can't send him a bad one and pay him like 50 Bucks or something even maybe more. I would lol. One in his hand would probably be fixed already. 
Amazing how much info he pulled from a device he knows nothing about.

Sent from my Galaxy Nexus using Tapatalk 2


----------



## darkspr1te

bryantjopplin said:


> From reading everything yes as long as your hardware is good. And this darkspr1te guy, Wtf, where has he been. He is a genius. To bad someone can't send him a bad one and pay him like 50 Bucks or something even maybe more. I would lol. One in his hand would probably be fixed already.
> Amazing how much info he pulled from a device he knows nothing about.
> 
> Sent from my Galaxy Nexus using Tapatalk 2


I would do it for free just to play with the tech 
Greetings all, I am here at the request of a few users to see if we can get a move on to resolve the issue at hand, The damaged bootloaders.
I am needing a dump of partition 4 (ebr) to finish building a bootloader restore.
to get the partition from a working device we use dd, a 32gb and 16gb ebr are different (as are mbr).



Code:


<br />
<br />
adb shell<br />
dd if=/dev/block/mmcblk0p4 of=/locationofsdcard/ebr.bin count=100 bs=512<br />
exit<br />
adb pull /locationofsdcard/ebr.bin<br />
<br />

once if have a known ebr i can continue with my fake partition restructure/rebuild and understand the layout a little more.
I already have the mbr and bootloaders and i have a example of the partition table layout but the ebr will be the icing.

I also require a fdisk/gparted listing of the emmc so i know what the cylinders/sectors and head count are as seen by the device.
example below, ignore the values, they are not for/from your device and are here as a example of the data i need.



Code:


<br />
<br />
$ /sbin/fdisk -lu disk.img<br />
You must set cylinders.<br />
You can do this from the extra functions menu.<br />
<br />
Disk disk.img: 0 MB, 0 bytes<br />
255 heads, 63 sectors/track, 0 cylinders, total 0 sectors<br />
Units = sectors of 1 * 512 = 512 bytes<br />
<br />
      Device Boot      Start         End      Blocks   Id  System<br />

regard

darkspr1te


----------



## ph3d

Installing SDK as we speak and will pull the information needed


----------



## ph3d

hmm cm10 does not seem to pickup adb devices - backing up and restoring my ics-nandroid - is there a specific driver needed for the touchpad? Google usb one does not seem to do the job in cm10


----------



## ph3d

[email protected]:/sbin # fdisk
fdisk
BusyBox v1.20.2-cm9 bionic (2012-07-14 01:52 +0200) multi-call binary.
Usage: fdisk [-ul] [-C CYLINDERS] [-H HEADS] [-S SECTORS] [-b SSZ] DISK
Change partition table
-u Start and End are in sectors (instead of cylinders)
-l Show partition table for each DISK, then exit
-b 2048 (for certain MO disks) use 2048-byte sectors
-C CYLINDERS Set number of cylinders/heads/sectors
-H HEADS
-S SECTORS
1|[email protected]:/sbin # fdisk -lu disk.img
fdisk -lu disk.img
fdisk: can't open 'disk.img': No such file or directory

Where is the emmc located?

EBR attached.


----------



## ph3d

http://www.2shared.com/file/Nk4NZHsC/ebr.html


----------



## Remolten

Glad to see were making progress. I hope jcsullins comes back though as everyone with the question mark of death is going to need some extra help.


----------



## unbrick

hey guys,

can somebody pls answer my post and i don't understand why you are talking about
adb flashing !? when your devices are bricked NO adb is possible, otherwise its not bricked.
so let us concentrate on flashing a retail bootloader (osbl.mbn) to the device using qpst and when this is done
we could restore.


----------



## bryantjopplin

ph3d said:


> hmm cm10 does not seem to pickup adb devices - backing up and restoring my ics-nandroid - is there a specific driver needed for the touchpad? Google usb one does not seem to do the job in cm10


Try downloading the WiFi adb app and it should work on any version. I use it and it works great.

Sent from my Galaxy Nexus using Tapatalk 2


----------



## bryantjopplin

unbrick said:


> hey guys,
> 
> can somebody pls answer my post and i don't understand why you are talking about
> adb flashing !? when your devices are bricked NO adb is possible, otherwise its not bricked.
> so let us concentrate on flashing a retail bootloader (osbl.mbn) to the device using qpst and when this is done
> we could restore.


 he needs it from a non bricked tp so he can build a new one that's why he is saying use adb

Sent from my Galaxy Nexus using Tapatalk 2


----------



## tolookah

unbrick said:


> hey guys,
> 
> can somebody pls answer my post and i don't understand why you are talking about
> adb flashing !? when your devices are bricked NO adb is possible, otherwise its not bricked.
> so let us concentrate on flashing a retail bootloader (osbl.mbn) to the device using qpst and when this is done
> we could restore.


For those with a touchpad (what this thread is about). Right now we need to determine what our partition tables look like because our restore procedure right now does not fix that. Have you looked for other threads about your device? I'm not trying to push you away, but thinking you may get better help elsewhere (they do have different chipsets)


----------



## unbrick

yes of course i did, and they have only different processors but both developed by qualcomm and both can use qpst.
i know all tech. details about my device like the partitions etc. and also tried to build the mbn file for my device which is needed to flash with
qpst but the python files for building this are missing.
trust me we have exactly the same problem but i have all mbn files an table names from backup.
i just dont know how to get ready with the qpst programm...


----------



## darkspr1te

unbrick said:


> hey guys,
> 
> can somebody pls answer my post and i don't understand why you are talking about
> adb flashing !? when your devices are bricked NO adb is possible, otherwise its not bricked.
> so let us concentrate on flashing a retail bootloader (osbl.mbn) to the device using qpst and when this is done
> we could restore.


The adb info is there for the users who have access to a second device so we can retrieve the right information, collection the information that shows the difference between devices give us a better understanding between the devices (example osbl.mbn is a msm7x based loader and would kill a msm8660 based device) 
so it's important we collect this data, if you view my original thread you will see what i mean and why it's important to identify the differences to come to to the final solution. more important in the cases where you wont have a unbrickable mod done to the device like my msm8660 based device, i can flash what ever the heck i want to and still be able to pull the device out from a dead hang or black screen of death, the same cannot be said for all devices.

As well here we are dealing with pre3 and later devices here (msm7x & msm8660) we have to be careful and specify the device that any backup comes from on the post, even if you have told every one you have a HP xyz already, it help's not hurts to specify the device on the actual post/attachment even if your prior post was related.


----------



## darkspr1te

unbrick said:


> yes of course i did, and they have only different processors but both developed by qualcomm and both can use qpst.
> i know all tech. details about my device like the partitions etc. and also tried to build the mbn file for my device which is needed to flash with
> qpst but the python files for building this are missing.
> trust me we have exactly the same problem but i have all mbn files an table names from backup.
> i just dont know how to get ready with the qpst programm...


I spent a very, very long time trying to make emmcswdownload.exe produce a working table (rawpartition.xml, patch0.xml etc) and i feel i wasted my time. My eventual solution was to put the device into sd-card mode using 8660_msimage.mbn and then write the bootloaders back to the device starting from sector 0 of the drive, i created dozens of .mbn loaders that never worked, using the same offsets and files that worked in my final debrick of my device. Even my eventual understanding of the .xml code i've not produced a working .mbn file from emmcswdownload.exe (i refer to the file in the .exe format as thats from command line and how you can build a .mbn in the same manner as the emmc_msimage.mbn to flash, except the one you build will have the bootloaders for your device and not the loaders from qualcomm that prodcuce the sd-card booting)

for those that are wondering about the rawpartition nad patch files, the rawpartition tell the qpst program at which offsett put which file (it does not care if the mbr/ebr exists or not, it just starts writing at xyz offset, patch.xml takes a zero'd partiton table, partition0.bin (a combination of mbr+ebr) and copies it to the device last, it then alters (Note a) the data on the disk to reflect the partitions listed in the prawpartitions.xml file)

Note A:
if patch0.xml is done incorrectly it will alter the file stored on your hdd (partition0.bin) or the one on the device, if you are using a backup then you wont need patch0.xml, it's enough to write the first block of partitotion0.bin (combo mbr+ebr backup, not zero'd) to sector 0 and then remaining blocks of partition0.bin to the first sector of the extended partition (most often /dev/block/mmcblk0p4 or offsett _[background=rgb(233, 233, 233)]13051 for 16gb model[/background]_). the ebr is never larger than about 11 blocks. 
another thing to note, one you run emmcswdownload.exe with a patch specified the local partition0.bin is forever altered, so it will not longer be a zero'd file but a real mbr/ebr reflection the information in rawpartition.xml and if thats incorrect it wont work.

One final note, i've noticed the offset in rawpartition.xml does not match gparted or fdisk for offset.

I hope this helps

darkspr1te


----------



## darkspr1te

ph3d said:


> [email protected]:/sbin # fdisk
> fdisk
> BusyBox v1.20.2-cm9 bionic (2012-07-14 01:52 +0200) multi-call binary.
> Usage: fdisk [-ul] [-C CYLINDERS] [-H HEADS] [-S SECTORS] [-b SSZ] DISK
> Change partition table
> -u Start and End are in sectors (instead of cylinders)
> -l Show partition table for each DISK, then exit
> -b 2048 (for certain MO disks) use 2048-byte sectors
> -C CYLINDERS	Set number of cylinders/heads/sectors
> -H HEADS
> -S SECTORS
> 1|[email protected]:/sbin # fdisk -lu disk.img
> fdisk -lu disk.img
> fdisk: can't open 'disk.img': No such file or directory
> 
> Where is the emmc located?
> 
> EBR attached.


you need to specify the device, in most cases it's /dev/block/mmcblk0 for whole device and /dev/block/mmblk0pX where X is partition number, if you are using the device as a whole you must specify count=Y where Y is number of blocks you wish to copy or you will attempt to copy the whole device.


----------



## darkspr1te

darkspr1te said:


> The adb info is there for the users who have access to a second device so we can retrieve the right information, collection the information that shows the difference between devices give us a better understanding between the devices (example osbl.mbn is a msm7x based loader and would kill a msm8660 based device)
> so it's important we collect this data, if you view my original thread you will see what i mean and why it's important to identify the differences to come to to the final solution. more important in the cases where you wont have a unbrickable mod done to the device like my msm8660 based device, i can flash what ever the heck i want to and still be able to pull the device out from a dead hang or black screen of death, the same cannot be said for all devices.
> 
> As well here we are dealing with pre3 and later devices here (msm7x & msm8660) we have to be careful and specify the device that any backup comes from on the post, even if you have told every one you have a HP xyz already, it help's not hurts to specify the device on the actual post/attachment even if your prior post was related.


My exact process to fix my device by hand.(in linux)

1.flash 8660_msimage.mbn 
2. using fdisk in linux create each partition entry as mentioned in the xml file for your device.
3. unplug device (while keeping battery in) to resync the partitions
4. write each bootloader to the required partition (for msm8660, sbl1 to partition2,sbl2 to part3, ebr to part 4, rpm to part5 etc)
then power cycle the device.

Thats a distilled version of what i did. the hard work was correcting the offsett issues which i could only do once i figured out the real partition table which would have been easier if i had the mbr,ebr and a fdisk listing of the partition table.


----------



## unbrick

ty, for your answers. yes i read all your posts downloaded fixbrix etc. but my main problem is that even with fitting files
qpst wont flash to the device. could it be that my corrupted osbl.mbn makes it unpossible to flash via adbadapter?
and how could you make the 8660_msimage.mbn (i read the posts on anyclub.com but dont have the python files to generate this mbn)
of course i need another file for my device to flash.
And In do not think that flashing a wrong bootloader would "kill" the device.
maybe jtag is the only possibility.

e: and what means
1.flash 8660_msimage.mbn in linux how did you do this

and i have msm8255t and osbl.mbn wo why do you think its msm7x


----------



## darkspr1te

unbrick said:


> ty, for your answers. yes i read all your posts downloaded fixbrix etc. but my main problem is that even with fitting files
> qpst wont flash to the device. could it be that my corrupted osbl.mbn makes it unpossible to flash via adbadapter?
> and how could you make the 8660_msimage.mbn (i read the posts on anyclub.com but dont have the python files to generate this mbn)
> of course i need another file for my device to flash.
> And In do not think that flashing a wrong bootloader would "kill" the device.
> maybe jtag is the only possibility.
> 
> e: and what means
> 1.flash 8660_msimage.mbn in linux how did you do this
> 
> and i have msm8255t and osbl.mbn wo why do you think its msm7x


I have not come across a msm8225t yet but anyclug.org mentions them together quite often in the same way the msm8660 and msm8960 are mentioned together, must be because they are of similar or same architecture. Hence i said osbl.mbn was msm7x. (E:V:A on xda would be able to really confirm the validity of this part, ive done most of my digging into the 8660 so thats why i am really up to speed on )

i dont know if the 8660 .mbn file will work on the msm8225, it might need it's own .mbn file from qualcomm. if that is the case then i am not sure what to suggest, the turning point for me was getting my hands on 8660_msimage.mbn, only then did the bits start falling into place and my first unbrick happened.

there could be a 8225_msimage.mbn out there.


----------



## unbrick

no there is none, but i could easily build one when i had these python files -.-
but do you think i could flash the osbl file although my device is in download mode and bootloader bricked?
and when i start emmcswdownload.exe the device is selected successfully but the download button is grayed out!
can you pls upload the xml you have used, than i could edit for my device.


----------



## ph3d

darkspr1te - i am not sure which partition contains the emmc data - I THOUGHT for a second it was mmcblk0p12 as this shows as RISC/Boot but unable to pull any partition information from any of the partitions when using fdisk. I have added some information gathered from a 32GB Touchpad



Code:


<br />
[email protected]:/dev/block # ls<br />
ls<br />
dm-0<br />
dm-1<br />
dm-10<br />
dm-11<br />
dm-12<br />
dm-13<br />
dm-2<br />
dm-3<br />
dm-4<br />
dm-5<br />
dm-6<br />
dm-7<br />
dm-8<br />
dm-9<br />
loop0<br />
loop1<br />
loop2<br />
loop3<br />
loop4<br />
loop5<br />
loop6<br />
loop7<br />
mmcblk0<br />
mmcblk0p1<br />
mmcblk0p10<br />
mmcblk0p11<br />
mmcblk0p12<br />
mmcblk0p13<br />
mmcblk0p14<br />
mmcblk0p2<br />
mmcblk0p3<br />
mmcblk0p4<br />
mmcblk0p5<br />
mmcblk0p6<br />
mmcblk0p7<br />
mmcblk0p8<br />
mmcblk0p9<br />
platform<br />
ram0<br />
ram1<br />
ram10<br />
ram11<br />
ram12<br />
ram13<br />
ram14<br />
ram15<br />
ram2<br />
ram3<br />
ram4<br />
ram5<br />
ram6<br />
ram7<br />
ram8<br />
ram9<br />
vold<br />
[email protected]:/dev/block # fdisk -lu /dev/block/mmcblk0p13<br />
fdisk -lu /dev/block/mmcblk0p13<br />
<br />
Disk /dev/block/mmcblk0p13: 33 MB, 33554432 bytes<br />
4 heads, 16 sectors/track, 1024 cylinders, total 65536 sectors<br />
Units = sectors of 1 * 512 = 512 bytes<br />
<br />
Disk /dev/block/mmcblk0p13 doesn't contain a valid partition table<br />
[email protected]:/dev/block # fdisk -lu /dev/block/mmcblk0p14<br />
fdisk -lu /dev/block/mmcblk0p14<br />
<br />
Disk /dev/block/mmcblk0p14: 31.2 GB, 31237079040 bytes<br />
4 heads, 16 sectors/track, 953280 cylinders, total 61009920 sectors<br />
Units = sectors of 1 * 512 = 512 bytes<br />
<br />
Disk /dev/block/mmcblk0p14 doesn't contain a valid partition table<br />
[email protected]:/dev/block # fdisk -lu /dev/block/mmcblk0p10<br />
fdisk -lu /dev/block/mmcblk0p10<br />
<br />
Disk /dev/block/mmcblk0p10: 3 MB, 3145728 bytes<br />
4 heads, 16 sectors/track, 96 cylinders, total 6144 sectors<br />
Units = sectors of 1 * 512 = 512 bytes<br />
<br />
Disk /dev/block/mmcblk0p10 doesn't contain a valid partition table<br />
[email protected]:/dev/block # fdisk -lu /dev/block/mmcblk0p11<br />
fdisk -lu /dev/block/mmcblk0p11<br />
<br />
Disk /dev/block/mmcblk0p11: 3 MB, 3145728 bytes<br />
4 heads, 16 sectors/track, 96 cylinders, total 6144 sectors<br />
Units = sectors of 1 * 512 = 512 bytes<br />
<br />
Disk /dev/block/mmcblk0p11 doesn't contain a valid partition table<br />
[email protected]:/dev/block # fdisk -lu /dev/block/mmcblk0p12<br />
fdisk -lu /dev/block/mmcblk0p12<br />
<br />
Disk /dev/block/mmcblk0p12: 4 MB, 4194304 bytes<br />
4 heads, 16 sectors/track, 128 cylinders, total 8192 sectors<br />
Units = sectors of 1 * 512 = 512 bytes<br />
<br />
Disk /dev/block/mmcblk0p12 doesn't contain a valid partition table<br />
[email protected]:/dev/block # fdisk -lu /dev/block/mmcblk0<br />
fdisk -lu /dev/block/mmcblk0<br />
<br />
Disk /dev/block/mmcblk0: 31.9 GB, 31908167680 bytes<br />
1 heads, 16 sectors/track, 3895040 cylinders, total 62320640 sectors<br />
Units = sectors of 1 * 512 = 512 bytes<br />
<br />
			  Device Boot	  Start		 End	  Blocks  Id System<br />
/dev/block/mmcblk0p1			   1	  204800	  102400   c Win95 FAT32 (LBA)<br />
Partition 1 does not end on cylinder boundary<br />
/dev/block/mmcblk0p2   *	  204801	  205800		 500  4d Unknown<br />
Partition 2 does not end on cylinder boundary<br />
/dev/block/mmcblk0p3		  205801	  208800		1500  51 Unknown<br />
Partition 3 does not end on cylinder boundary<br />
/dev/block/mmcblk0p4		  208801	62189567	30990383+  5 Extended<br />
Partition 4 does not end on cylinder boundary<br />
/dev/block/mmcblk0p5		  262144	  263143		 500  47 Unknown<br />
/dev/block/mmcblk0p6		  393216	  394715		 750  45 Unknown<br />
/dev/block/mmcblk0p7		  524288	  529287		2500  4c Unknown<br />
/dev/block/mmcblk0p8		  655360	  675839	   10240  48 Unknown<br />
/dev/block/mmcblk0p9		  786432	  789431		1500  46 Unknown<br />
/dev/block/mmcblk0p10		 917504	  923647		3072  4a Unknown<br />
/dev/block/mmcblk0p11		1048576	 1054719		3072  4b Unknown<br />
/dev/block/mmcblk0p12		1054720	 1062911		4096  f0 Linux/PA-RISC boot<br />
/dev/block/mmcblk0p13		1062912	 1128447	   32768  83 Linux<br />
/dev/block/mmcblk0p14		1179648	62189567	30504960  8e Linux LVM<br />
[email protected]:/dev/block #<br />

Also looking at a Camera patch updater script shows EMMC as ext3 but on p13 - but alas I cant pull any partition information needed unless i need to specify where the block begins and ends or add something else to my fdisk command?



Code:


<br />
assert(getprop("ro.product.device") == "tenderloin" || getprop("ro.build.product") == "tenderloin" || getprop("ro.product.board") == "tenderloin");<br />
<br />
show_progress(0.100000, 0);<br />
<br />
mount("ext3", "EMMC", "/dev/block/mmcblk0p13", "/boot");<br />
package_extract_file("boot.img", "/boot/uImage.CyanogenMod");<br />
unmount("/boot");<br />
<br />
show_progress(0.700000, 0);<br />
<br />
mount("ext4", "EMMC", "/dev/store/cm-system", "/system");<br />
package_extract_dir("system", "/system");<br />
unmount("/system");<br />
<br />
show_progress(0.100000, 0);<br />


----------



## TopTongueBarry

darkspr1te,

I voiced the following concern previously, and feel it warrants revisiting. ph3d and others appear to be running the disgnostic commands for you from within in instance of CM9 running on top of (for lack of a better way to explain booting from an image file ) residing on /media/internal in webOS . /media/internal in webOS is the equiv of sdcard in Android. I'm afraid the results you get from fdisk using adb shell on "android" instance may not be valid.

Partition information for cyls heads and sectors might be more accurately drawn from the bricked device after running your brixfix1 process by using testdisk , a GPL utility that analyzes and restores damaged or deleted partiton tables.

It is important to member not to write the recovered partiton table table back to the device or it will be in the state it was in before brixfix was run, seemingly bricked, back in QHUSB-DLOAD only mode. Of course thats not tragic either thanks to your discoveries.

I may be voiceing unfounded fears about running fdsik to gather the partition information from an adb shell running in CM9 instance on top of webOS, however, I felt you needed to be aware of this in case it does matter before we begin using any process based on the results obtained so far.

As mentioned, testdisk utility will give accurate cyl, heads and sector information on the device'd emmc disk, but your brixfix process needs to be run first to gain access to the device, and its important to remember if restoring original partition table as recovered at this stage using testdisk, then device will be put back in state it was in before brixfix was run. testdisk can be exited without writing the recovered partition table back to disk so its not a big deal either way.

TTB 



ph3d said:


> darkspr1te - i am not sure which partition contains the emmc data - I THOUGHT for a second it was mmcblk0p12 as this shows as RISC/Boot but unable to pull any partition information from any of the partitions when using fdisk. I have added some information gathered from a 32GB Touchpad
> 
> 
> 
> Code:
> 
> 
> <br />
> [email protected]:/dev/block # ls<br />
> ls<br />
> dm-0<br />
> dm-1<br />
> dm-10<br />
> dm-11<br />
> dm-12<br />
> dm-13<br />
> dm-2<br />
> dm-3<br />
> dm-4<br />
> dm-5<br />
> dm-6<br />
> dm-7<br />
> dm-8<br />
> dm-9<br />
> loop0<br />
> loop1<br />
> loop2<br />
> loop3<br />
> loop4<br />
> loop5<br />
> loop6<br />
> loop7<br />
> mmcblk0<br />
> mmcblk0p1<br />
> mmcblk0p10<br />
> mmcblk0p11<br />
> mmcblk0p12<br />
> mmcblk0p13<br />
> mmcblk0p14<br />
> mmcblk0p2<br />
> mmcblk0p3<br />
> mmcblk0p4<br />
> mmcblk0p5<br />
> mmcblk0p6<br />
> mmcblk0p7<br />
> mmcblk0p8<br />
> mmcblk0p9<br />
> platform<br />
> ram0<br />
> ram1<br />
> ram10<br />
> ram11<br />
> ram12<br />
> ram13<br />
> ram14<br />
> ram15<br />
> ram2<br />
> ram3<br />
> ram4<br />
> ram5<br />
> ram6<br />
> ram7<br />
> ram8<br />
> ram9<br />
> vold<br />
> [email protected]:/dev/block # fdisk -lu /dev/block/mmcblk0p13<br />
> fdisk -lu /dev/block/mmcblk0p13<br />
> <br />
> Disk /dev/block/mmcblk0p13: 33 MB, 33554432 bytes<br />
> 4 heads, 16 sectors/track, 1024 cylinders, total 65536 sectors<br />
> Units = sectors of 1 * 512 = 512 bytes<br />
> <br />
> Disk /dev/block/mmcblk0p13 doesn't contain a valid partition table<br />
> [email protected]:/dev/block # fdisk -lu /dev/block/mmcblk0p14<br />
> fdisk -lu /dev/block/mmcblk0p14<br />
> <br />
> Disk /dev/block/mmcblk0p14: 31.2 GB, 31237079040 bytes<br />
> 4 heads, 16 sectors/track, 953280 cylinders, total 61009920 sectors<br />
> Units = sectors of 1 * 512 = 512 bytes<br />
> <br />
> Disk /dev/block/mmcblk0p14 doesn't contain a valid partition table<br />
> [email protected]:/dev/block # fdisk -lu /dev/block/mmcblk0p10<br />
> fdisk -lu /dev/block/mmcblk0p10<br />
> <br />
> Disk /dev/block/mmcblk0p10: 3 MB, 3145728 bytes<br />
> 4 heads, 16 sectors/track, 96 cylinders, total 6144 sectors<br />
> Units = sectors of 1 * 512 = 512 bytes<br />
> <br />
> Disk /dev/block/mmcblk0p10 doesn't contain a valid partition table<br />
> [email protected]:/dev/block # fdisk -lu /dev/block/mmcblk0p11<br />
> fdisk -lu /dev/block/mmcblk0p11<br />
> <br />
> Disk /dev/block/mmcblk0p11: 3 MB, 3145728 bytes<br />
> 4 heads, 16 sectors/track, 96 cylinders, total 6144 sectors<br />
> Units = sectors of 1 * 512 = 512 bytes<br />
> <br />
> Disk /dev/block/mmcblk0p11 doesn't contain a valid partition table<br />
> [email protected]:/dev/block # fdisk -lu /dev/block/mmcblk0p12<br />
> fdisk -lu /dev/block/mmcblk0p12<br />
> <br />
> Disk /dev/block/mmcblk0p12: 4 MB, 4194304 bytes<br />
> 4 heads, 16 sectors/track, 128 cylinders, total 8192 sectors<br />
> Units = sectors of 1 * 512 = 512 bytes<br />
> <br />
> Disk /dev/block/mmcblk0p12 doesn't contain a valid partition table<br />
> [email protected]:/dev/block # fdisk -lu /dev/block/mmcblk0<br />
> fdisk -lu /dev/block/mmcblk0<br />
> <br />
> Disk /dev/block/mmcblk0: 31.9 GB, 31908167680 bytes<br />
> 1 heads, 16 sectors/track, 3895040 cylinders, total 62320640 sectors<br />
> Units = sectors of 1 * 512 = 512 bytes<br />
> <br />
> Device Boot	  Start		 End	  Blocks  Id System<br />
> /dev/block/mmcblk0p1			   1	  204800	  102400   c Win95 FAT32 (LBA)<br />
> Partition 1 does not end on cylinder boundary<br />
> /dev/block/mmcblk0p2   *	  204801	  205800		 500  4d Unknown<br />
> Partition 2 does not end on cylinder boundary<br />
> /dev/block/mmcblk0p3		  205801	  208800		1500  51 Unknown<br />
> Partition 3 does not end on cylinder boundary<br />
> /dev/block/mmcblk0p4		  208801	62189567	30990383+  5 Extended<br />
> Partition 4 does not end on cylinder boundary<br />
> /dev/block/mmcblk0p5		  262144	  263143		 500  47 Unknown<br />
> /dev/block/mmcblk0p6		  393216	  394715		 750  45 Unknown<br />
> /dev/block/mmcblk0p7		  524288	  529287		2500  4c Unknown<br />
> /dev/block/mmcblk0p8		  655360	  675839	   10240  48 Unknown<br />
> /dev/block/mmcblk0p9		  786432	  789431		1500  46 Unknown<br />
> /dev/block/mmcblk0p10		 917504	  923647		3072  4a Unknown<br />
> /dev/block/mmcblk0p11		1048576	 1054719		3072  4b Unknown<br />
> /dev/block/mmcblk0p12		1054720	 1062911		4096  f0 Linux/PA-RISC boot<br />
> /dev/block/mmcblk0p13		1062912	 1128447	   32768  83 Linux<br />
> /dev/block/mmcblk0p14		1179648	62189567	30504960  8e Linux LVM<br />
> [email protected]:/dev/block #<br />
> 
> Also looking at a Camera patch updater script shows EMMC as ext3 but on p13 - but alas I cant pull any partition information needed unless i need to specify where the block begins and ends or add something else to my fdisk command?
> 
> 
> 
> Code:
> 
> 
> <br />
> assert(getprop("ro.product.device") == "tenderloin" || getprop("ro.build.product") == "tenderloin" || getprop("ro.product.board") == "tenderloin");<br />
> <br />
> show_progress(0.100000, 0);<br />
> <br />
> mount("ext3", "EMMC", "/dev/block/mmcblk0p13", "/boot");<br />
> package_extract_file("boot.img", "/boot/uImage.CyanogenMod");<br />
> unmount("/boot");<br />
> <br />
> show_progress(0.700000, 0);<br />
> <br />
> mount("ext4", "EMMC", "/dev/store/cm-system", "/system");<br />
> package_extract_dir("system", "/system");<br />
> unmount("/system");<br />
> <br />
> show_progress(0.100000, 0);<br />


----------



## jcsullins

Guys,

I just uploaded TPDebrick v0.1.

Here's the thread I opened for it:

http://rootzwiki.com/topic/36658-tpdebrick-v01/


----------



## jcsullins

Remolten said:


> So I'm guessing this means the question mark of death will still be unfixable.


Not clear at this point.

I'd say that just restoring the partitioning/bootsectors (probably) will not cure it.

However, there may be a way to pull the bootie configuration and modify it that might help in some way.


----------



## bryantjopplin

jcsullins said:


> Not clear at this point.
> 
> I'd say that just restoring the partitioning/bootsectors (probably) will not cure it.
> 
> However, there may be a way to pull the bootie configuration and modify it that might help in some way.


What's the difference?

Sent from my Galaxy Nexus using Tapatalk 2


----------



## Remolten

bryantjopplin said:


> What's the difference?
> 
> Sent from my Galaxy Nexus using Tapatalk 2


Touchpad's with the question mark of death aren't "bricked". The Touchpad checks every time it turns on to see if a battery exists or not. If it thinks it isn't there, it shows that picture (even though it obviously is as it turned on) so something in the actual booting would have to be changed.


----------



## bryantjopplin

Remolten said:


> Touchpad's with the question mark of death aren't "bricked". The Touchpad checks every time it turns on to see if a battery exists or not. If it thinks it isn't there, it shows that picture (even though it obviously is as it turned on) so something in the actual booting would have to be changed.


Can it be tricked?

Sent from my Galaxy Nexus using Tapatalk 2


----------



## Remolten

bryantjopplin said:


> Can it be tricked?
> 
> Sent from my Galaxy Nexus using Tapatalk 2


We should be able to eventually find a way to "trick" it so to say.


----------



## gsausalito

Hi:


jcsullins said:


> However, there may be a way to pull the bootie configuration and modify it that might help in some way.


Yes, at least in my case.

My 64GB TP suffered battery drain.
I Do not know how because it was plugged to the wall charger, running android
and battery showed 0%, so i plugged the Touchstone and brought the TP
to the Touchstone and after a while central button began to blink showing
a led moving from left to right. I left TP at Touchston several hours but nothing booted.
I reset the TP pressing On/Off button and central button for 15 seconds and the
famous Interrogation mark inside the battery appeared.
I attached the TP to the wall charger and the same icon was in screen 4 or 5 hours
until i reset the TP again and the central button began to flash again.

A i said, in my case, i can change from central button blinking to interrogation mark and
if i reset the TP and keep pressing On/Off button and Vol- Interrogation mark disappears and
the screen goes black; at this step i plug the TP to the computer and W7 asks for a *qhsusb_dload*
driver; if i reset the TP and keep pressing On/Off and Vol+ W7 asks for a Palm driver.

I loaded the qhsusb_dload driver x64 and QPST sees a device attached at com 4 in download mode
( i'll pray my download mode be bootie mode )
but my only successful operation was getting software version using this software.

So, YES, in my case, and i supose not being the only one, i can change from one to another "status".

Regards from Spain.


----------



## onkel

hi, has anyone the MPRG8660.HEX or download link which work ?? thanks


----------



## darkspr1te

onkel said:


> hi, has anyone the MPRG8660.HEX or download link which work ?? thanks


http://forum.xda-developers.com/showthread.php?t=2136738
Darkspr1te

Sent from my A210 using Tapatalk HD


----------



## kocoman

dadwarf said:


> This address is the same for TouchPad and Pre3 in fact it's relative to QDL that allow something to be upload only from this address (0x 80 00 00 00).
> 
> You can try with QPST the log could tell you exactly what going wrong :
> 
> 
> Download QPST, MPRG7X30.HEX, MPRG8660.HEX
> Launch "Software Download", go to "Multi-image"
> rename "MPRGXXXX.HEX" to "EMMCBLD.HEX"
> select "Sec Boot 2.0" as "Boot system", select the folder of your HEX (it doesn't matter if you have the other files it's just to upload the bootloader)
> click "Start"
> go to menu "Help / Open Log File Directory", open Dload_COMx.dbg and see !


does anyone still have the MPRG7X30.HEX, files above? its now 404'ed

the bad link is from the same user dadwarf

http://dadwarf.blogspot.com/2012/09/working-on-hp-pre-3-stuck-in-download.html

thanks


----------



## bhanvadia

Can anyone provide me partition.mbn 16gb, partition0 or link me to guide for making mbn


----------

