I was trying to downgrade my phone from android 10 to android 7.1 (stock firmware). I have done this before and it always worked, except this time the flash-all.bat tool stopped while extracting the system image. I tried switching USB ports, running the commands myself and this is when it stopped working: I flashed the bootloader, restarted it into the bootloader but it tried booting to system and failed. Now it's hard bricked. I did not lock the bootloader.

After I did some digging I found out I can use an EDL cable to force it into QEDL mode. However, i have never done this before and saw in YouTube videos that you need a processor specific .mbn file. I cannot find them anywhere so far (there was an arabic website with no download link to their unbricking tool).

TL;DR - My phone hard bricked with the bootloader unlocked and I need help on flashing Qualcomm MSM8996 Pro SoC firmware. My PC still detects it as Qualcomm HS-USB QDloader 9008.

  • So the device is not entering bootloader mode if you reboot and hold power + vol down?
    – Robert
    Commented Jun 11, 2020 at 16:27
  • look in this chat. user @najam shared some collections for firehose programmers (afaik google never leaked some, but worth a try) android.stackexchange.com/q/225752
    – alecxs
    Commented Jun 11, 2020 at 20:38
  • I tried multiple button combinations, none worked. If it helps, bootloader and radio are from version nde63h, while the rest is qp1a.191005.007.a3. Thanks for the link, I will try to keep you all updated.
    – David
    Commented Jun 12, 2020 at 9:36

1 Answer 1


I found this tutorial, but it needs the firehose programmer file, which I can't find anywhere, not for sailfish (https://www.leakite.com/collection-qualcomm-emmc-programmer-files/) Here's the link, in case anyone needs it: https://www.youtube.com/watch?v=z90cQ1whiSE . If you find it, please reply to this and I'll add it. Good luck!

Part 2:

So I finally found out about "Driver Binaries", files Google provides on their site, although no instructions are provided. I downloaded both of the files for 7.1.0 nde and ran the .sh file. Read the agreement and typed "I AGREE", after which the shell created a folder called vendor. Inside are BoardConfigPartial.mk, device-partial.mk and "proprietary" folder.

From what I searched, these are Makefile extensions to build the actual firmware, and all source code is stored in the proprietary folder found earlier. There seems to be a rampatch .img and a dedicated msm8996_camera.xml, and even more interestingly, another folder called lib64 which contains gps.default.so, libwifi-hal-qcom.so. Lots of files inside but I'm not going to go into details. The purpose of this comment is to let anyone more experienced with compiling and building software from raw code hopefully compile all of this into a single flashable .mbn.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .