Jolla C is now a brick

[MoritzJT]

After about a week of testing and setting up my new Jolla C I had to repartition my SD-Card that had one partition f2fs and one SWAP to ext4 and swap. I did so using parted from openrepos and creating a new partition table on said card. The card mounted fine on Jolla C as did the SWAP partition. After a while I decided to reboot the phone and since then it has not turned back on. No vibration, nothing.

I fear that somehow the NAND could be affected by partition table writing? Is there a way to connect NAND to a PC and check if everything is okay, or do I have to send in the device?

Connecting the Phone to PC shows QHSUSB__BULK in device manager - maybe this is a starting point towards flashing the device or repairing something.

Overview:

1: Tinker with partition tables on sdcard presumably - as that did work - mounted fine as swap and ext4
2: attempt reboot
3: stay dead
4: take out SIM and sdcard
5: attempt boot - stay dead
6: attempt recovery (vol-up + power) / fastboot (vol-down + USB) - stay dead
7: connect to PC - QHSUSB__BULK in device manager
8: open ticket at ZENDESK

Has anyone got a clue? :D

[EDIT]

9: get help from the inner circle
10: be educated QHSUSB__BULK mode basically exports the emmc via USB

[EDIT] (QHSUSB__BULK will either say Qualcomm 9008 (service port) or Qualcomm 9006 (emmc mode) the one we need)

11: expected behaviour on linux: show emmc partitions and list device on /dev/whatever
12: actual behaviour lsusb lists device as connected to one USB bus but does not list as any device to the system
13: conclusion - send in the device - as even with the by now provided original partition table, there seems to be no way to write them back to my Jolla C
14: sob and tremble uncontrollably
15: buy iPhone - jk

[mosen]

You may keep the pieces :cool:

[MoritzJT]

I will decorate my trophy collection with this new brick! But I'd much prefer to let it age well before that ;)

[Dave999]

No worries. As far as I know you didn't bought a phone but part of a program.

Hou...tricky one...
Send it to jolla and tell them to fix it since it broke on first start up ;) and request a new...

[mosen]

Just for the record, you did not mention trying to get into recovery menu.
You sure tried and it did not work, correct?

[MoritzJT]

I had opened a ticket earlier and will await their answer.

Hope they can help me out.

I did try recovery and fastboot (voldown + usb)

Nothing works, the device stays black. Only thing is upon connecting to USB said device pops up in device manager indicating something is severely wrong.

[mosen]

Good to read you take it like a man :)

[MoritzJT]

Me taking it this way is nothing compared to the poor folks longing for one and seeing me waste mine just like this.

Don't behead me!

[mosen]

At least you documented what not to do.
Can be helpfull indeed.

[pichlo]

You did not mention if you tried rebooting without the offending SD card.

[kjokinie]

I had opened a ticket earlier and will await their answer

Hope they can help me out.

I did try recovery and fastboot (voldown + usb)



The correct key combo for recovery mode is Vol UP + power key. Please try that ;)

Also good idea to remove any sd card from the device if you have such there. Unfortunate partition label could cause an issue..

[MoritzJT]

I've updated my first post with hopefully enough info as to what I've tried and what does not do the trick ;) Thanks for reminding me!

[nieldk]

Sadly, what most likely happened, is a deleted/faulty SBL partition, this is the Qualcomm bootloader damaged, and only repairable by Qualcomm tools. The device boots to this mode when normal bootloader partition is damaged, thus the device can't boot.
So far none has figured out how to repair this, outside factory (except on XDA forum, for a few devices).
This happened for at least one user here, on J1 (search my answers)

[MoritzJT]

Well if that really is the case - and by all means a quick google search pushed me into the XDA case too - then Qualcomm thus Jolla should have documentation on it, should they not? Maybe they can share what is needed - or tell us why we can't have it.

Thank you for this insight. I will wait for an official response from Jolla before any further tampering with my Jolla C in its current state.

Regards!

[TMavica]

Hero.......
Aquafish is your way to go

[Tsippaduida]

MoritzJT, seems obvious, but have you let the battery to rest properly? In the early days of J1, I issued a halt from command line, and the phone was a brick. But battery out for 15 minutes and back in and then it started. But as I said, you probably have tried this already.

[MoritzJT]

Thank's for the heads up, sadly that's also one of the things I had tried.

The ticket I opened with Jolla Care was closed and I have been redirected to developer-care@jolla.com - forwarding them my issue. They are yet to answer me.

I hope I'm not screwed here. Back in my Symbian days, bricking a device was nearly impossible - even dead flashing and correcting the partitions layout was easily possible, because we had all the tools necessary. With Jolla, Qualcomm and what not - this is an extremely sad situation. Dependency on the big manufacturers and THEIR rules makes me angry.

[MoritzJT]

A little update - Jolla C does not come with any warranty according to Jolla. I'll have to pay for transport AND reparing. I'm waiting for Jolla to tell me how much it will cost to repair my device and decide whether to send it in.

[javispedro]

Possibly if you can wait to the next Jolla event you might find some sailor willing to reflash it for you...

[MoritzJT]

What kind of Jolla event would that be? I've never been to one. Do sailors themselves have access to the factory images?

[coderus]

If you connect usb while holding voldown, fastboot will be availavle?

[MoritzJT]

lsusb still lists a qualcomm device, it will however not list as a block device - the last thing I hoped for.

There is no more fastboot.

[nieldk]

If you connect usb while holding voldown, fastboot will be availavle?

No, the only way to safe this device is using Qualcomm tools. Ian not sure if even Jolla got those (they are licensed $$$)
Read my answers to this special bootloader mode in other threads.
While the mentioned tool can be found, pirated, we still need certain files and XML partition layout for this.

It's not undoable, but we don't have all the pieces of the puzzle.

[javispedro]

What kind of Jolla event would that be? I've never been to one. Do sailors themselves have access to the factory images?

I suspect any event where Jolla sends one or more hackers. Only FOSDEM comes to mind right now, but I hope there's some earlier developer/community event before that (like the JollaC one).

Obviously, at least some sailors have access to factory images and flashing tools.

[nieldk]

Obviously, at least some sailors have access to factory images and flashing tools.

Interesting , do you know who?

For others, like I said, the SBL(1) is erased/damaged and thus the phone don't know how to boot. Leaving it in this factory mode. Unable to enter fast boot, recovery, or, normal boot.

There is good reference, also how this can be fixed on certain Android devices.

If we can create similar for Jolla phones, yes, it is recoverable , but until then, probably only the factory can recover this.

More info: http://forum.xda-developers.com/showthread.php?t=2625332

[MoritzJT]

I will make a case against being able to modify SBL or partition tables from the phone in general just by being root. There should be one more layer of protection.

I have been through many of the XDA resources along with some android unbrick blogs - they all rely on the provided images. I have yet to see a 'reverse engineered' effort succeed reviving a phone with some frankenstein image.

Citation from a comment I received on the following resource by androidbrick: http://www.androidbrick.com/ultimate-qualcomm-snapdragon-unbrick-guide-snapdragons-are-unbrickable-qhsusb_dload_qpst_qfil/

"Thank you so much for the kind words. As to your problem : Qualcomm 9008 port is simply just a “service port” that waits right files from you to wake up the device. Just a commication port, you cant manualy flash anything over it. You need a proper service rom that includes ““rawprogram0.xml”, “patch0.xml”, “prog_emmc_firehose_XXXX.mbn” or “MPRGXXXX.mbn”” in it, without those files your phone cant come back sorry. Those mbn files are a must to turn your bricked phone into EMMC mode again (Qualcomm 9006), so your phone’s EMMC drive will wake and accepts your backed up partititons again from linux or from an other windows based partition software.. So you just need to find those, or nothing can be done, sorry. Greetings."

So for now that means we (I) need to switch from Qualcomm 9008 (service port) to Qualcomm 9006 (emmc mode) requiring:

- rawprogram0.xml
- patch0.xml
- MPRGXXXX.mbn (as at least Jolla C listens to Sahara protocoll, not the supposedly newer Firehose protocol)

And I don't even think that the .mbn file is the actual whole ROM, in our case SFOS but just the part needed to revive the device. Does it include anything that falls under NDA? Who can tell.

That's our situation, judging from the dead Jolla 1 thread.

[nieldk]

The mbm files can indeed contain full rom.
But to recover only the SBL is needed.
The xml files can proberly be reconstrocted, proberly also the mbm files, but not without a great deal of effort.

So, yes, as I said, at the moment most likely only the factory have all the pieces to this.

[nodevel]

I will make a case against being able to modify SBL or partition tables from the phone in general just by being root. There should be one more layer of protection.

Being able to do it only as root is the protection, so I am against any "uber-root" hurdles you're proposing.

<rant>
The problem is that people (especially Android users, but many people on TMO as well) don't realize what it means to do stuff as root. With the power comes a great responsibility and regular users should never play with root access.

Yet there's a lot of "yo yo, I just rooted my phone, just because I can" attitude.

Just look at the "SailfishOS pre-pre-release" threads where good amount of users goes through an unnecessary risk and then is surprised when something breaks. There were plans by Jolla last summer to introduce upgrades that would overwrite the system partition so you don't have to hop over updates every time after resetting your phone, but imagine what disaster it would be if they tried to do it and bunch of users went ahead with their

for i in {1..5}; do version --dup; done # five times to upgrade all packages, because some fail to upgrade at first

routine prematurely...
</rant>

There should be no "just by being root".

[javispedro]

Interesting , do you know who?

Well, rainisto and Stskeeps both mentioned at some point having it.
However, to the best of my knowledge, both have left the company. :/

[mosen]

Just look at the "SailfishOS pre-pre-release" threads where good amount of users goes through an unnecessary risk and then is surprised when something breaks.

I stand corrected and have underestimated a well know effect.

http://www.goethezeitportal.de/fileadmin/Images/db/wiss/goethe/schnellkurs_goethe/k_8/zauberlehrling.jpg

Do you suggest to not even create dedicated posts here on TMO for those topics or how should this be handled ethically correct?

[nieldk]

I stand corrected and have underestimated a well know effect.

http://www.goethezeitportal.de/fileadmin/Images/db/wiss/goethe/schnellkurs_goethe/k_8/zauberlehrling.jpg

Do you suggest to not even create dedicated posts here on TMO for those topics or how should this be handled ethically correct?

Most, or many, posts comes with a big warning.

But, perhaps, making a pinned post stating the dangers of God mode ?

[lantern]

Can we save the SBL from live phone for backup?

[nieldk]

Can we save the SBL from live phone for backup?

A good idea to do so, helpful I believe once its figured out how to extract the needed files.

The partitions of J1 is like this, not sure of C.



Model: MMC MAG2GC (sd/mmc)
Disk /dev/mmcblk0: 15.6GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Disk Flags:

Number Start End Size File system Name Flags
1 17.4kB 4194kB 4177kB emgdload
2 33.6MB 67.1MB 33.6MB QOTP
3 67.1MB 71.3MB 4194kB Qfa
4 71.3MB 75.5MB 4194kB Qcfg
5 75.5MB 79.7MB 4194kB Qdlog
6 79.7MB 81.8MB 2097kB Qvariables
7 81.8MB 83.9MB 2097kB Qlogfilter
8 101MB 105MB 4194kB fsg
9 134MB 185MB 50.3MB ext4 Qglog
10 185MB 189MB 4194kB modemst1
11 189MB 193MB 4194kB modemst2
12 193MB 195MB 2097kB sbl1
13 195MB 197MB 2097kB sbl2
14 197MB 199MB 2097kB sbl3
15 199MB 201MB 2097kB tz
16 201MB 203MB 2097kB rpm
17 203MB 206MB 2097kB aboot
18 206MB 273MB 67.1MB fat16 modem msftdata
19 273MB 281MB 8389kB ext4 drm
20 281MB 294MB 12.6MB boot
21 294MB 306MB 12.6MB recovery
22 306MB 315MB 8389kB pad1
23 315MB 323MB 8389kB misc
24 323MB 856MB 533MB linux-swap(v1) swap
25 856MB 864MB 8389kB ext4 persist
26 864MB 864MB 8192B ssd
27 864MB 872MB 8389kB security
28 872MB 15.6GB 14.8GB btrfs sailfish

[PamNor]

Can we save the SBL from live phone for backup?

Jolla C partition:

parted /dev/mmcblk0
GNU Parted 3.1
Using /dev/mmcblk0
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) print
Model: MMC Q823MB (sd/mmc)
Disk /dev/mmcblk0: 15,6GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Disk Flags:

Number Start End Size File system Name
Flags
1 67,1MB 134MB 67,1MB fat16 modem
2 134MB 135MB 524kB sbl1
3 135MB 135MB 524kB sbl1bak
4 135MB 136MB 1049kB aboot
5 136MB 137MB 1049kB abootbak
6 137MB 138MB 524kB rpm
7 138MB 138MB 524kB rpmbak
8 138MB 139MB 786kB tz
9 139MB 140MB 786kB tzbak
10 140MB 141MB 1049kB pad
11 141MB 143MB 1573kB modemst1
12 143MB 144MB 1573kB modemst2
13 144MB 145MB 1049kB misc
14 145MB 145MB 1024B fsc
15 145MB 145MB 8192B ssd
16 145MB 156MB 10,5MB splash
17 201MB 201MB 32,8kB DDR
18 201MB 203MB 1573kB fsg
19 203MB 203MB 16,4kB sec
20 203MB 237MB 33,6MB boot
21 237MB 1390MB 1153MB ext4 system
22 1390MB 1423MB 33,6MB ext4 persist
23 1423MB 1692MB 268MB ext4 cache
24 1692MB 1725MB 33,6MB recovery
25 1725MB 1727MB 1049kB devinfo
26 1745MB 1745MB 524kB keystore
27 1745MB 1746MB 524kB config
28 1746MB 15,6GB 13,9GB userdata


(parted)

[nieldk]

Interresting - so, the C have backups of the critical partitions.

[MoritzJT]

Interresting - so, the C have backups of the critical partitions.


What are they good for if you delete their table too :eek:

[nieldk]

What are they good for if you delete their table too :eek:

Teaching people who shouldn't be messing around, the hard way.

[MoritzJT]

No that's the task of what follows if you mess with them ;)

However - what are the backup partitions good for, can the primary ones get corrupted? Is it used for some ongoing check against?

[r0kk3rz]

No that's the task of what follows if you mess with them ;)

However - what are the backup partitions good for, can the primary ones get corrupted? Is it used for some ongoing check against?

It's probably the recovery method since we know it will be different to that on the JPhone due to lack of Btrfs.

That doesn't help you, but as you found out if you aren't super careful when running fdisk as root you can break things :P

[nthn]

But, perhaps, making a pinned post stating the dangers of God mode ?
One of the most important rules of the internet is that nobody has ever read a sticky.

[pichlo]

One of the most important rules of the internet is that nobody has ever read a sticky.

No one ever reads text written in ALL CAPS either. Which is why all EULAs are written that way.

[nieldk]

Back to thread topic.
What I am thinking, is that it might be possible to switch USB modes, so that the device will expose its NAND thru USB, and allow us to mount it in linux.
Then, following that, we could restore the device partitions, from a copy of a working device. Or, in Jolla C, perhaps from thoise backup partitions.

I didnt test, but perhaps Jolla exposes more modes in this condition. Like it was found for Samnsung devices, which exposed 2 modes, allowing to access the modem, make calls, etc.

https://github.com/ud2/advisories/tree/master/android/samsung/nocve-2016-0004

Tells how this was done on Samsung devices.
And


https://github.com/ud2/advisories/blob/master/android/samsung/nocve-2016-0004/usbswitcher.c

Have a exploit that might be modifiable to work (if more modes avail).

[MoritzJT]

It must be possible to switch between modes. However the Qualcomm Tools didn't make it obvious on how to do so. Judging from the advice from androidunbrick as stated in my post here: https://talk.maemo.org/showpost.php?p=1511892&postcount=26

it's necessarry to have the flashable files to get it to fire up EMMC exposure mode again - and without those files it wouldn't be possible. I don't think however, that the mode that exposes EMMC somehow relies on working partition tables or any files from NAND. It would make much more sense if the exposure itself would remain independent and there actually IS a way to achieve what you're suggesting.

I guess without someone with deep technical knowledge in the field, we're a bit stranded :-(

[nieldk]

It must be possible to switch between modes. However the Qualcomm Tools didn't make it obvious on how to do so. Judging from the advice from androidunbrick as stated in my post here: https://talk.maemo.org/showpost.php?p=1511892&postcount=26

it's necessarry to have the flashable files to get it to fire up EMMC exposure mode again - and without those files it wouldn't be possible. I don't think however, that the mode that exposes EMMC somehow relies on working partition tables or any files from NAND. It would make much more sense if the exposure itself would remain independent and there actually IS a way to achieve what you're suggesting.

I guess without someone with deep technical knowledge in the field, we're a bit stranded :-(

What I need, is a bricked device ;)

[MoritzJT]

What I need, is a bricked device ;)

Where to? :D

Well I would also be extremely careful if my device wasn't bricked. Maybe we succeed switching modes once, but not back to normal. So far I see why you'd need one. I could send mine over if you're keen on experimenting, but I don't see why you'd do it - you get nothing out of it - there's nothing I can offer.

Currently I'm waiting for Jollas reply to my flashing images rant I attached to my support request. James has been relaying that info to the team and is awaiting a proper response. Afterwards I'll see what to do next.

Meanwhile I'll try to tinker with Qualcomm tools again.

[lantern]

Here's a good topic on qualcomm diag modes and restore, although you need to know russian.
http://4pda.ru/forum/index.php?showtopic=643084&st=4240

[MoritzJT]

I had come across that forum, however I know no russian and google translate does a miserable job at tech talk ;) But maybe someone can scan these pages? Thank you for the link!

[gerbick]

I had come across that forum, however I know no russian and google translate does a miserable job at tech talk. But maybe someone can scan these pages? Thank you for the link!

Perhaps ask coderus?

[gerstavros]

I bricked my Intex fish too. Where can i find the firmware for flashing from pc?

[mautz]

Maybe this helps:

https://jolla.zendesk.com/hc/en-us/articles/204709607-Jolla-Phone-How-do-I-use-the-Recovery-Mode-

[Zose]

Hello everybody,

i just find STOCK ROM for Intex Aqua Fish with all files from Qualcomm, maybe will be useful for your issues with Jolla C, personally i'm not tried.

https://firmwarefile.com/intex-aqua-fish

Fingers crossed :-)

-:Zose:-

[mosen]

Welcome to TMO!
Isn't firmwarefile.com some click bait site?
It also shows a firmware is available for my Archos 79 Xenon which would be unprecedented ;)

Have you actually downloaded something?
What was the filename?

Edit, right, something is downloading -> 1.45 GB Intex_Aqua_Fish_2.0.2.48_l500d_IN_0.0.1.32.zip

[aspergerguy]

Well there is content in the .zip :D
https://s4.postimg.org/rhwgz19i5/Aqua_Fish.png (https://postimg.org/image/au4ywjeqh/)

Guide upon qcomDloader-tool here:https://androidmtk.com/use-qcomdloader-tool

[kick]

try this take battery out for 10 seconds reinsert while holding down both volume rockers and insert usb install qualcomm port driver on QHSUSB__BULK (if windows 8 8.1 and 10 enable test mode first)_ from herehttps://drive.google.com/open?id=0B1DOj6UVkwZ0NTJuU1NmMTZZSHM
and use qualcomm flashing utility from the folder to flash a fresh firmware for your jolla c(sorry i own a intex aqua fish and they arent exactly same to be cross compatible with firmware so you need to find firmware on your own) [P.S. the folder isnt actually been made complete as im uploading stuff constantly wait for a little bit for the qualcomm tools to be uploaded must be done by the time you read this ] also refer to this tuitorial for exact steps for qualcomm flashing on sailfish deviceshttps://www.youtube.com/watch?v=EPqYiBTiRmY(btw theres a slight chance that the imei would be gone so you'd have to rewrite it ive included a tool that allows imei rewriting after flash just in case you have a corrupted imei)

[kick]

please note that telephony is differnt in intex aqua fish and jolla c so dont try flashing aqua fish firmware on jolla c

[P.S. the software i included was used by me to fix my aqua fish witch i had bricked on trying to downgrade from 2.1.1.24 to 2.1.0.11 so no guarantees that itll work on a jolla c that's bricked probably of a diffrent reason just dont complain if you hard brick it while trying to install aqua fish firmware i really am just trying to emphasise this and will say it very clearly

DO NOT FLASH AQUA FISH FIRMWARE ON JOLLA C THERE ARE MAJOUR CHANCES THAT YOULL END UP MESSING YOUR PHONE'S TELEPHONY WITH NO HOPE OF FIXING IT

so yea thats all i have to say for now good luck:o ]

[coderus]

modem firmware can be flashed separately with no issues

[kick]

tough where would one find the modem fw for jolla c

[nieldk]

tough where would one find the modem fw for jolla c

I think Coderus is saying you can use Intex FW, just dont flash modem part ;)

[coderus]

tough where would one find the modem fw for jolla c

from jolla repositories. just replace droid-modem-in package with droid-modem-eu one. this is tot a problem. tought part is restoring imei if you break calibration partition.

[kick]

imei of qualcomm chips can be written using a the tool i linked in my tools.rar file in my gdrive folder i havent tested it but it has instructions for it might work for the jolla c tough i think even it wont work if you break that partition

[kick]

also with the tools you cant really select what to flash and what not unlike for mediatek chipsets where you use a really easier toolkit called sp flash tools

[kick]

well the firmware files contain only these not droid-modem-in so im pretty confused can you explain