2

How does Qualcomm's QPST work? Or what protocol/commands does QPST use? As I wanted to develop an app like it, I searched for AT commands. But I can't find out any AT commands that allows me access(read/write) my old phone's internal file system(firmware). Any helps like the name of the commands/protocols that QPST uses are appreciated.

Or if my question is off-topic, where should I ask?

| improve this question | |
  • I think your question is fine, but maybe split it in one about qpst, and another about extracting firmware. – Willem Hengeveld Apr 7 '18 at 6:23
5

There is an open source project: openpst, which reimplements most functionality of the qpst tool.

Some of the protocols used are:

  • diag - used to read nv memory, and switch to dload mode using kDiagDload.
  • sahara - used by the primary bootloader in newer qualcomm chipsets
  • dload, used by bootroms, and older chipsets.
  • streaming dload - used by the flash loader.
  • firehose - the xml style protocol used with rawprogram0.xml files.

Flashing usually works like this:

  • switch to dload mode, this will start the bootloader.
  • upload the NPRG*.{hex,mbn} flash loader using the sahara protocol
    • the ENPRG* file is used for the emergency bootloader mode, launched when the bootrom cannot find a suitable primary bootloader in flash.
  • now talking to the NPRG loader, using the streaming dload protocol, upload and write binaries to flash.

Note that some manufacturers lock the bootrom, by fusing a specific certificate into the processor's One-time-programmable fuses. When this is the case, the bootrom will accept only specific binaries.

A collection of suitable binaries can be found here

| improve this answer | |
  • 1
    Oops, I didn't know that there were an open source project! Thanks. Then I may start from that. – KYHSGeekCode Apr 5 '18 at 8:09
  • is it possible to dump all the flash using NPRG ENPRG? – Zibri May 29 '19 at 15:40
  • I know it is possible with the firehose variants of NPRG or ENPRG – Willem Hengeveld May 31 '19 at 7:01
3

Use the sniffer for the communication channel it uses (most likely USB) to see which data is sent to your device. Try to search for the constants you see in the sniffer to find which binary may be responsible for generating the data sent to the device. Disassemble the binary, find the exact code piece responsible for protocol processing, decompile it manually. After having this knowledge, write your own code.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.