Before i begin, sorry for my bad english, i wont use a dictionary for this article, i will only use the words i already know, otherwise, this will be a never-ending story, becouse there are so many things to write..

It all began last summer, no no, this is not about a summer love, its a story about us and them. Us : Computer geeks from all around the world, Them : Samsung, Lg, Htc, Sony, etc. The firms who charge hundred of dollars to us, for our bricked phones, but in reality, there are not bricked, they just need the right factory rom and servise program to come back to life, for Snapdragons this is under 5 minutes.. It must have been the cheapest service charge, if time is a matter,  for our rooted ! and therefore are out of guarantie !  android phones .  But they mostly say :” motherboard has to be changed”, and this is the most high-priced servise all around the world, better buy a new phone !

Its year 2015, rooting is still forbidden from Them. Big applause to Oppo and to other firms who sell “developer” smartphones, who dont say out of guarantie if its rooted.  We will come to this later..

I bought a Nubia Z5s last year, from a chineese online seller and for my luck it came to my door with the postman. In my country there is a government rule, we citizens of Turkey can not buy any smartphone online from other countries. Its forbidden to protect local firms, the firms that charge 350 $ for a 100 $ worth chineese made smartphone, or 500$ for a 200$ worth chinnese made smartphone. And they sell it like they made it localy. In order to be able to use a foreign smartphone you should be returning from an foreign country and have a passport , the mark on it cant be older then 30 days, or you miss that chance too. Can you understand how hungry we are for these little toys ? 🙂 I bought my z5s for a 380 $ with free shipping, it was a real bargain for me, a Lg G2 those days, same snapdragon 800 platform with 2gb of ram and nubia had 4k video and 120fps shooting in plus, costed 750$ in my local shops. I was only be able to use it for 10 days, after that my government shut the signal of my non on a passport registered imei. I started to search for a passport from a friend, that must not be older then 30 days and should have not any other phone registered on it ! Some even sell their passport rights for 100 $ here. You can register on that passport, you pay 100$ to its owner, then you pay about 60$ to government as tax and your signal is back. If you are lucky to find a passport like this of course. Anyway this is enough of our problems ..

Im going it very quicly, dont want to talk about illegal stuff right now, .. I was the first user, geek, who could repair the imei of the new snapdragon 800 and 801 platforms on a windows PC . is born from those days and from these experiences.

Started with nubia series, i was lucky to find a way in only 2 hours reading the web and could repair the imei. Then i found a ZTE Grand S 2, snapdragon 801 this time, same folder structure like LG G2, was able to repair it too, after reading how to back up G2’s imei topic’s. That lead the way to Xiaomi Mi3’s, Mi4’s, Lenovo k910, and now 920, almost all brands from china that has qualcomm snapdragon platforms, i was able to repair their imei’s with registered ones, except till day, an Oneplus One came to my hands, to work on its imei.  A week later i introduces my self with one of the Qualcomm Service Ports, Qualcomm HS-USB QDLoader 9006, and the story began.



My Oneplus One gone HS-USB QDLoader 9006 mode after i willingly deleted aboot.mbn, was trying to find the partition in which Opo / Oppo was hiding his encyrpted imei, so i was in a hunt 🙂 After that bricked Opo has waited about a month on my desk, in a coma, i knew he wasnt dead, after a little research i came up with the unbrick tutorial of Oppo Find 5, in which the author was talking about about special drivers for QHSUSB_BULK device in device manager, later it turnes out to be that those ports are, after right drivers installed of course, quote from Qualcomm himself :

Usually the target is in emergency download when no image is present on the target or when the  image is corrupted. In such situation, the target will be enumerated as “Qualcomm HS-USB  QDLoader …” , ( mostly Qdloader 9008 in our examples ), when connected to a PC via USB.

It continues :

” When a phone is boot up normally and HLOS is running, the target will be enumerated as  “Qualcomm HS-USB Diagnostics …” or alike when connected to a PC via USB. In this situation, QFIL will automatically switch target to EDL mode and then load the build into the phone” .

Yes this quotes are taken from the operation guide of QFIL, we will talk about that program later, it will be probably our future unbrick tool for newer ( including msm8974) smartphones, coming with the latest build of QPST, 2.7 /422.


Now about the terms HLOS and EDL, : “This tool (QFIL) can be used to flash a build image into a target in the Emergency Download  (EDL) mode or from High Level OS (HLOS) mode (normal boot up). 

Interesting right ? Those ports, that we fear so much, are just qualcomm service ports. What more interesting is, with the right drivers and flashtools, and with the right device spesific servise rom, your hard bricked, in dead condition poor snapdragon, will come back to life in under 5 minutes !

The first service rom, that im talking about, has came from Oppo, as far as i know, for unbricking Find 5, with their special “DownloadTool” and with their spesific “Qualcomm QHSUSB BULK” or qhsusb_dload drivers, after installed our Qualcomm HS-USB  QDLoader or Qualcomm HS-USB Diagnostics ports are ready to serve.

I knew, if i could find the right service rom and flash tool for OnePlus One, i could rescue it and i was right. With the help of a friend from XDA.Developers, i managed to download a rom, which has our magic files in it, (names are spesific for msm8974 platform), “8974_msimage.mbn -bootloader, MPRG8974.mbn -flasher, ram (the format was hex before 8974), rawprogram0.xml -partitiontable definition, it differs if we have a 64GB phone or 32GB or a 16GB, name differs as rawprogram0_32G.xml or rawprogram0_64G.xml, patch0.xml -patch definition of the partitions”. We will come back to these files later, its a huge story itself. This wasnt a service rom for Opo normaly , it was just ColorOs 2.0 full install package, which has all the needed files for unbricking any Oneplus One from any 9006 or 9008 bulk situation !


In about 15 minutes, after my rom download has finished, i was able to rescue Oneplus One from “coma”  brick. But not with the “MSM8974 spesific DownloadTool” this time, becouse its all in chineese, hard to understand if something goes wrong, you can use Qfil instead, if its  “Qualcomm HS-USB  QDLoader 9008″, Qualcomm’s home made flash tool, if your service rom supports the new protocol “firehose”, the flasher is not MPRG8974.mbn anymore in this, unlike “Sahara” protocol, its called “prog_emmc_firehose_8974.mbn”, the coloros 2.0 rom package supports this protocol too, i was able to rescue my Opo from any situation later with Qfil (my test Oppo 7 too), made many tests rescuing from 9008 and 9006, after hard bricking them manualy of course. There is a tool called QCN Backup and Restore in Qfil, we all know what this is, the new kind of “EFS” backup used these days (all modem related nv_items backup).







,with the help of Miflash Utility from Xiaomi, its the magic flashtool for all snapdragon based phones from Xiaomi, their users are using it for their so called “Fastboot roms” for Mi3 or Mi4 etc. I was experienced to use it for a Lenovo K910 Vibe Z, an other msm8974 platform, again from a so called “deadly” brick situation, it was in hs-usb qdloader 9008 first, we just need “8974_msimage.mbn” and “MPRG8974.mbn” to bring the phone to hs-usb diagnostics 9006 mode. 9006 is “Emergency Download Mode” as i mentioned earlier, for “raw” level flashing. Then Miflash comes to help with its own “qualcomm bulk” drivers and sees our port to flash our non Xiaomi rom manualy.



Those who are familiar with Miflash will notice in the “Fastboot Script” row you dont see any “flash_local.xml”, becouse Oppo named it as Setting.xml, they are the same, no need to change any line in setting.xml, just choose right xml and mbn’s and hit “Flash”, after aboout 1.5-2 minutes your Opo or Oppo will come back alive. Greetings 🙂 Remember this method fixes all 9006’s from all makers of Snapdragon based smartphones like Lenovo K910, K920,

ZTE Nubia z7/z7max/z7mini ( those fastboot/service roms we have in our hands too), which has right “mbn” and “xml” files in their rom folders.

Now a big applouse to Xiaomi too, first was Oppo, now we know their “fastboot roms” are  “service roms” too ! You can unbrick any snapdragon based Xiaomi, if that model has a fastboot rom of course, from many bricked situation ( i dont wanna use hardbrick or softbrick terms anymore, they are not :)).

Chineese Smartphone makers seems more user-friendly then rest of the world makers, only their “service/fastboot” roms are easy to find ( motorolla too i think ) to fix many Qualcomm HS-USB  QDLoader 9008 bricks. How about the owners of a LG G3, or a HTC M8, or Sony Xperia Z series owners with same boogeyman 9008 port ? Or any other phone maker with the same  “out of guaranty-friendly” or  “motherboard has to be changed-friendly” philosophy..

To be continued ( with more tools and info )..


MiFlash version/2012:


QPST 2.7 Build 422 :


Lenovo K920 Vibe Z2 Pro Unbrick Rom :


Oppo 7/7a Unbrick Rom ( international 1.2.5):


Oneplus One Unbrick Rom ( ColorOs 2.0 ):




PS: I don’t advice to use the so called OnePlusRecoveryTool with CM11 in it. Going back from ColorOs to CM11 if needed takes only 5 minutes ! Why to take not your own build Msm8974DownloadTool and call it a your made tool ? Without understanding whats realy in it ? Just describe how to do it with the original files, anyway, i always think new users should stay away from those “tools”, they first need to read and understand what they are doing that moment, try to learn and understand basic fastboot and adb commands, much safer, much fun !


PART 2 :  ! !






Copyright © 2015 by All rights reserved.

Leave a Reply

293 Yorum - "Ultimate Qualcomm Snapdragon Unbrick Guide, Snapdragon’s are UNBRICKABLE !"

Sıralama:   En Yeniler | Eskiler | Beğenilenler
Hi thanks alot but my problem is that when i connected my zte nubia z7 max to pc(i just updated & it got suddenly after the restart,completely off), only human interfface device is being shown & i can’t choose another driver from qualcomm or andoid usb or anything..I have installed all drivers…I have revived z7mini with your work but it was recognized by device manager.not like this phone…plz help me(the red circle get on,so phone is ot completely dead) Plz advise me as how to change the recognition from “human interface device” to sth else…i saw 3-5 people in interet… Read more »
HI, I have the opneplus one 64GB. Rootet with cm14.1and TWRP. But the phone is now hard brick. I can´t go to fast boot . Device manager gergenize my phone as QDLoader 9008. With the MSMdownload tool have a problem it goes to loop with download the file 8974_msimage.mbn ( it is a never ending loop). I try to flash the phone with Miflash. But I have an error DownloadFlashProgrammer(369): An attempt was made to load a file with an incorrect format.(0x8007000b) DownloadFlashProgrammerAndMiniKernel(753): An attempt was made to load a file with an incorrect format.(0x8007000b) CSoftwareDownload::DownloadBySettings(1879): An attempt was made… Read more »
Hi, thanks for the great job that you make. I have a opneplus one which is now in the 9008 mode. I try to flash it with MiFlash. But the I became an error. DownloadFlashProgrammer(369): An attempt was made to load a file with an incorrect format.(0x8007000b) DownloadFlashProgrammerAndMiniKernel(753): An attempt was made to load a file with an incorrect format.(0x8007000b) CSoftwareDownload::DownloadBySettings(1879): An attempt was made to load a file with an incorrect format.(0x8007000b) CEmergencyFlasher::DoWork(525): An attempt was made to load a file with an incorrect format.(0x8007000b) CDeviceReport::HasError(67): An attempt was made to load a file with an incorrect format.(0x8007000b) CDeviceReport::GetStatus(124):… Read more »
Hi! Thanks for all your work. I have a Sony Xperia L in hard brick (after modifying the sdcard partition from TWRP) (no power, no bootload, …) I’ve been trying to recover it with QPST/QFli and MiFlash, but with no result (I can see it correctly in both tools – dload – , but I need the extra files since I just have a stock rom. I understand from your comments that MiFlash won´t work with Sony. Should I continue trying with Qfil? If so, can you direct me to where I could find the needed files? If both methods… Read more »

I accidentally have flashed wrong rom in my Asus zenfone 2 ZE550kl.The is hard bricked.No light no fastboot,no recovery.Its Qualcomm® Snapdragon™ 410
Qualcomm Snapdragon 615 MSM8939. Can you help to unbrick


Firmware for Asus are available in product support page as flashable zip files.mbn files are present in that but no XML files .BTW I am using win 10 with qfil in Windows 7 compatibility mode


How can I find ROM with magic files for my device?


The 16 part indicates the Qualcomm MSM8916 Snapdragon 410, so if I use the same files from the same chipset but from another firmware, would not be ok? I tried flashboot too, but I get theFAILED ( remote: flash write failure) error.


Great tutorial. Unfortunatelly most firmwares on the net as in my case will not include the prog_emmc_firehose_8916 (blu studio 7 lte) nor the rawprogram0 xml. So. Is there a way to generate those files? Or to download them? If so,can someone upload them? The unable to download flashprogramer error qfil gives is due to this


Hello. Are this methods working on Huawei’s devices? I have a Huawei Ascend Y550. I’m sorry for my terribe english.


Hello. Do Some of this methods works for Huawei Ascend Y550?


I have a moto e 1st gen hard bricked device with Qualcomm Snapdragon 200 processor. it does n’t even boot up fastboot. but it is detected as “Qualcomm HS-USB QDLoader 9008” in device manger when connected to pc. can it at all be unbricked? i checked it does nt have “blank flash files”(programmer files_ which are specific to devices). manufacture have n’t released those. can you please check it once? i really need to unbrick it. thanks in advance 🙂


Hey, i bricked my oppo r5s with a flash to cm13. Now i want to unbrick it. The MsM8x39Downloadtool.exe have found my phone. After i press Start it says “starting to receive a sahara protocol”. And nothing more happen. after 30min i quit it.
What can i do to unbrick my phone?

IT WORKS!!! [ For those who has a “Partition table missing” experience in Lenovo Qualcomm device] After a week struggling to unbrick my device, I decided to get two days skipping my unbrick activities and let my self busy with unrelated things instead. Then today, I tried to continue to unbrick my device. It’s needs only less than 30 minutes to bring my Lenovo back to live!! Just a day before my plan to bring it to Lenovo service center. Thanks to Androidbrick’s MiFlash tool works, the tool successfully create all partition to my device and flashed it with stock… Read more »
Hi Android Brick, Here are my Lenovo Qualcomm MSM8225Q Snapdragon S4 Play conditions: 1. Bootloop. 2. Cannot access recovery. 3. Qualcomm HS-USB QD-LOADER 9008 detected. 4. I have everything: Firehose, .mbn files, .xml files, .hex file, etc 5. Qfil & QPST failed, sahara failed, idle rolling cursor, etc. 6. Partition table missing. 7. Remove the rest of partitions, and turns into one single partition via minitool. 8. Fastboot failed. 9. no more logo lenovo, only black screen. 10. still vibrating once when power button pressed. 11. Command “fastboot devices” no longer works. 12. Any fastboot command no longer work, only… Read more »

hi i just bricked my letv x800 phone and tried using the Qfil way to unbrick it, but i get the following error when i follow instructions:

Download Fail:Unable to download Flash Programmer using Sahara Protocol
before i got a different msg before updating drivers

Download Fail:Switch To EDL FailFailed to Switch to Emergency Download mode

I looked all over the net and nothing i found works, the only thing i have not tried is using windows 10. I got latest drivers Qualcomm_Diag_QD_Loader_2016_driver, but nothing works any insight would be great

Greetings! Some more questions, Sir! 🙂 1. What sort of information do Sahara/Firehose programmer files do contain? (Just the instructions needed to write to emmc, or does it dictate other details too eg. partition table, filesystem type, partition flags(-RW, -r, hidden) etc.) 2. Are there tools to reverse-engineer them, or “look into” them to see what they contain? (Since they’re binary, I don’t expect the answer to be yes, but still) 3. How are they generated? 4. Since programmers meant for different models, with the same SOC can’t be used interchangeably because of them containing manufacturers-specific sign-codes, where does the… Read more »
To quote you: Qualcomm’s home made flash tool, if your service rom supports the new protocol “firehose”, the flasher is not MPRG8974.mbn anymore in this, unlike “Sahara” protocol, its called “prog_emmc_firehose_8974.mbn” ______________ So, basically what you’re saying is, if the ROM supports the new protocol “Firehose”, there’s no need for a MPRG××××.mbn. My question is, if my ROM contains prog_emmc_firehose_8974.mbn, a. is there a need for MPRG8974.mbn to be present? b. in Qfil, the program exits with an error message “fail: sahara fail”. What can be the reason, despite the programmer being for firehose and not sahara? You might want… Read more »
I’m sure you’re aware that the primary bootloaders on Qualcomm Snapdragon SoCs are programmed to boot from sd card if the emmc is corrupted. All that’s needed to go into fastboot is to: 1. Take an image of the complete emmc (*) from a working device of the same model. 2. Write the image onto an sd card. And with the sdcard inserted, boot up the phone into fastboot mode. While in fastboot, one can do pretty much anything. Maybe, you should do a tutorial on this. And presumably this could be the “universal method” for any/all snapdragons from every… Read more »