How does QPST work and how can I make an app like it?

Question

How does Qualcomm's QPST work? Or what protocol/commands does QPST use? As I wanted to develop an app like it, I searched for AT commands. But I can't find out any AT commands that allows me access(read/write) my old phone's internal file system(firmware). Any helps like the name of the commands/protocols that QPST uses are appreciated.

Or if my question is off-topic, where should I ask?

Answer 1

There is an open source project: openpst, which reimplements most functionality of the qpst tool.

Some of the protocols used are:

• diag - used to read nv memory, and switch to dload mode using kDiagDload.
• sahara - used by the primary bootloader in newer qualcomm chipsets
• dload, used by bootroms, and older chipsets.
• streaming dload - used by the flash loader.
• firehose - the xml style protocol used with rawprogram0.xml files.

---

Flashing usually works like this:

• switch to dload mode, this will start the bootloader.
• upload the NPRG*.{hex,mbn} flash loader using the sahara protocol
  • the ENPRG* file is used for the emergency bootloader mode, launched when the bootrom cannot find a suitable primary bootloader in flash.
• now talking to the NPRG loader, using the streaming dload protocol, upload and write binaries to flash.

Note that some manufacturers lock the bootrom, by fusing a specific certificate into the processor's One-time-programmable fuses. When this is the case, the bootrom will accept only specific binaries.

A collection of suitable binaries can be found here

Answer 2

Use the sniffer for the communication channel it uses (most likely USB) to see which data is sent to your device. Try to search for the constants you see in the sniffer to find which binary may be responsible for generating the data sent to the device. Disassemble the binary, find the exact code piece responsible for protocol processing, decompile it manually. After having this knowledge, write your own code.