There is an open source project: openpst, which reimplements most functionality of the qpst tool.
Some of the protocols used are:
- diag - used to read nv memory, and switch to dload mode using
kDiagDload
.
- sahara - used by the primary bootloader in newer qualcomm chipsets
- dload, used by bootroms, and older chipsets.
- streaming dload - used by the flash loader.
- firehose - the xml style protocol used with
rawprogram0.xml
files.
Flashing usually works like this:
- switch to dload mode, this will start the bootloader.
- upload the
NPRG*.{hex,mbn}
flash loader using the sahara protocol
- the
ENPRG*
file is used for the emergency bootloader mode, launched when the bootrom cannot find a suitable primary bootloader in flash.
- now talking to the
NPRG
loader, using the streaming dload protocol, upload and write binaries to flash.
Note that some manufacturers lock the bootrom, by fusing a specific certificate into the processor's One-time-programmable fuses. When this is the case, the bootrom will accept only specific binaries.
A collection of suitable binaries can be found here