How To Guide - Some hints about EDL mode | XDA Forums

How To Guide Some hints about EDL mode

Search This thread

bnsmb

Senior Member
Aug 22, 2017
412
224
Frankfurt
This post contains some information about the EDL mode that I found out while testing the EDL mode for the ASUS Zenfone 8. I am not an expert in this field, so this article is probably neither complete nor error-free.

I only tested EDL mode using a PC running Linux (Fedora 39).

EDL mode is a special mode for phones using one of the Qualcomm CPUs.

"In this mode, the device identifies itself as Qualcomm HS-USB 9008 through USB. EDL is implemented by the PBL. Since the PBL is a ROM resident, EDL cannot be corrupted by software. The EDL mode itself implements the Qualcomm Sahara protocol, which accepts an OEM-digitally-signed programmer (an ELF binary in recent devices, MBN in older ones) over USB, that acts as an SBL. Modern such programmers implement the Firehose protocol, analyzed next." (copied from here : https://alephsecurity.com/vulns/aleph-2017028/)

"EDL or Emergency DownLoad Mode is a special boot mode in Qualcomm Android devices that allows OEMs to force-flash firmware files. This special mode of operation is also commonly used by power users to unbrick their devices."

EDL mode is not intended for the normal phone user. So if you don't know why you should use it, don't use it.


The necessary tools for Linux to access a phone in EDL mode can be downloaded from here:

https://github.com/bkerler/edl

Use the installation instructions for your Linux distribution on that page to install the EDL tools.

Or use the LiveCD with the tools available on the Website.

There are also instructions for installing the tools on a PC running the Windows "OS" (in the end it's "only" a python script) but I did not test them.

Another Windows tool to access a phone in EDL mode is available here: https://www.temblast.com/edl.htm


Some important things you might miss (at least I did ...).

SELinux must be disabled if active using the command:

Code:
sudo setenforce 0

The required udev rules for EDL must be in place, e.g.

Code:
[ OmniRom 14 Dev - xtrnaw7@t15g /data/develop/android/edl ] $  cat /etc/udev/rules.d/51-edl.rules

# Qualcomm EDL
SUBSYSTEMS=="usb", ATTRS{idVendor}=="05c6", ATTRS{idProduct}=="9008", MODE="0666", GROUP="plugdev"

# Sony EDL
SUBSYSTEMS=="usb", ATTRS{idVendor}=="0fce", ATTRS{idProduct}=="9dde", MODE="0666", GROUP="plugdev"
SUBSYSTEMS=="usb", ATTRS{idVendor}=="0fce", ATTRS{idProduct}=="ade5", MODE="0666", GROUP="plugdev"

# Qualcomm Memory Debug
SUBSYSTEMS=="usb", ATTRS{idVendor}=="05c6", ATTRS{idProduct}=="9006", MODE="0666", GROUP="plugdev"

# Qualcomm Memory Debug
SUBSYSTEMS=="usb", ATTRS{idVendor}=="05c6", ATTRS{idProduct}=="900E", MODE="0666", GROUP="plugdev"

# LG Memory Debug
SUBSYSTEMS=="usb", ATTRS{idVendor}=="1004", ATTRS{idProduct}=="61a1", MODE="0666", GROUP="plugdev"

# Sierra Wireless
SUBSYSTEMS=="usb", ATTRS{idVendor}=="1199", ATTRS{idProduct}=="9071", MODE="0666", GROUP="plugdev"

# ZTE
SUBSYSTEMS=="usb", ATTRS{idVendor}=="19d2", ATTRS{idProduct}=="0076", MODE="0666", GROUP="plugdev"
[ OmniRom 14 Dev - xtrnaw7@t15g /data/develop/android/edl ] $

If this is not the case install the udev rules using these commands:

Code:
cd <edl_tools_dir>

sudo cp Drivers/51-edl.rules /etc/udev/rules.d

sudo udevadm control --reload
sudo udevadm trigger

Afterwards, disconnect and reconnect the phone to use the new udev rules.

Note that the udev rules for EDL mode in the rules file that is part of the EDL tools should be fine for all phones with a Qualcomm CPU.

To double check, compare the USB Vendor ID and Product ID of your phone while in EDL mode with the contents of the file /etc/udev/rules-d/51-edl.rules, example:

Code:
[ OmniRom 14 Dev - xtrnaw7@t15g /data/develop/android/edl ] $ lsusb | grep QDL
Bus 003 Device 037: ID 05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode)
[ OmniRom 14 Dev - xtrnaw7@t15g /data/develop/android/edl ] $

[ OmniRom 14 Dev - xtrnaw7@t15g /data/develop/android/edl ] $ grep 05c6 /etc/udev/rules.d/51-edl.rules
SUBSYSTEMS=="usb", ATTRS{idVendor}=="05c6", ATTRS{idProduct}=="9008", MODE="0666", GROUP="plugdev"
SUBSYSTEMS=="usb", ATTRS{idVendor}=="05c6", ATTRS{idProduct}=="9006", MODE="0666", GROUP="plugdev"
SUBSYSTEMS=="usb", ATTRS{idVendor}=="05c6", ATTRS{idProduct}=="900E", MODE="0666", GROUP="plugdev"
[ OmniRom 14 Dev - xtrnaw7@t15g /data/develop/android/edl ] $

To access the phone via EDL a Firehose loader for the phone is required. There are already some Firehose loader included in the EDL tools in the sub directories of the directory ./Loaders:

Code:
[ OmniRom 14 Dev - xtrnaw7@t15g /data/develop/android/edl ] $ ls Loaders/
amazon         blackphone f10q       GM           hmd     hydrogen         letv       lyf       meizu     mmx           oneplus putyourloadersinhere.txt  README.md  smartisan TCL     vivo           zte
asus_wingtech  blackshark  fancymaker haier        HuaQin __init__.py     LG         megafone  micromax   nokia_foxconn ontim   qmc                       samsung   sonim     tplink   xiaomi
blackberry     cyanogen    gionee     hisense_agm  huawei  lenovo_motorola longcheer  meitu     microsoft nothing       oppo     qualcomm                 sharp     sony       unknown yulong_coolpad
[ OmniRom 14 Dev - xtrnaw7@t15g /data/develop/android/edl ] $

There is also a repository for loaders available at https://github.com/bkerler/Loaders that you can check for a loader for your phone.

A firehose loader for the ASUS Zenfone 8 is available here ASUS_Zenfone8_prog_firehose_ddr.elf and here is a zip file with other Firehose loader for the ASUS Zenfone 8: 02A firehose.zip. (all Firehose loader from hat archive work on my ASUS Zenfone 8)

A table with known Firehose loader is available here http://www.temblast.com/ref/loaders.htm.

To boot the phone into EDL mode, first boot the phone into the Android OS with working access via adb and then execute on the PC:
Code:
adb reboot edl
If rebooting into EDL works, the phone should only show a blank screen now and neither fastboot nor adb should detect a phone.


To check if the phone is in EDL mode, use lsusb, e.g:

Code:
[ OmniRom 14 Dev - xtrnaw7@t15g /data/develop/android/edl ] $  lsusb
....
Bus 003 Device 031: ID 05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode)
...
[ OmniRom 14 Dev - xtrnaw7@t15g /data/develop/android/edl ] $

The phone in EDL mode is the USB device in "QDL mode". If such a device is not present, the phone is not in EDL mode.


Before you can execute EDL commands, you must load the Firehose loader for your device using this command (replace prog_firehose_ddr.elf with the loader for your phone)

Code:
./edl   --loader=/data/backup/ASUS_ZENFONE8/edl/prog_firehose_ddr.elf

This must be executed once as first command each time you enter the edl mode.


Note

If you do not have a loader for your phone, you can test the automatic selection of the edl script by running edl without specifiying a loader, e.g:


Output if edl does NOT find a loader for the phone

Code:
[ OmniRom 14 Dev - xtrnaw7@t15g /data/develop/android/edl ] $ ./edl getstorageinfo
Qualcomm Sahara / Firehose Client V3.62 (c) B.Kerler 2018-2023.
main - Trying with no loader given ...
main - Waiting for the device
......
main - Hint:   Press and hold vol up+dwn, connect usb. For some, only use vol up.
main - Xiaomi: Press and hold vol dwn + pwr, in fastboot mode connect usb.
       Run "./fastpwn oem edl".
main - Other:  Run "adb reboot edl".

.........main - Device detected :)
sahara - Protocol version: 2, Version supported: 1
main - Mode detected: sahara
sahara -
Version 0x2
------------------------
HWID:             0x001350e100290875 (MSM_ID:0x001350e1,OEM_ID:0x0029,MODEL_ID:0x0875)
CPU detected:     "lahaina"
PK_HASH:           0x0e172e7799ab2674eacaee35e098e8b505ae768f7a2418ca653abecbe02198c3e3993a98b34fd8ecbb971c0c8b770e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Serial:           0x4dcc2414

sahara
sahara - [LIB]: Couldn't find a loader for given hwid and pkhash (001350e100290875_0e172e7799ab2674_[FHPRG/ENPRG].bin) :(

Output if edl finds a loader for the phone

Code:
[ OmniRom 14 Dev - xtrnaw7@t15g /data/develop/android/edl ] $ ./edl getstorageinfo
Qualcomm Sahara / Firehose Client V3.62 (c) B.Kerler 2018-2023.
main - Trying with no loader given ...
main - Waiting for the device
main - Device detected :)
main - Mode detected: sahara
Traceback (most recent call last):
 File "/data/develop/android/edl/./edl", line 393, in <module>
   base.run()
 File "/data/develop/android/edl/./edl", line 295, in run
   version = conninfo["data"].version
            ^^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: type object 'req' has no attribute 'version'
[ OmniRom 14 Dev - xtrnaw7@t15g /data/develop/android/edl ] $ ./edl getstorageinfo
Qualcomm Sahara / Firehose Client V3.62 (c) B.Kerler 2018-2023.
main - Trying with no loader given ...
main - Waiting for the device
......
main - Hint:   Press and hold vol up+dwn, connect usb. For some, only use vol up.
main - Xiaomi: Press and hold vol dwn + pwr, in fastboot mode connect usb.
       Run "./fastpwn oem edl".
main - Other:  Run "adb reboot edl".

.......main - Device detected :)
sahara - Protocol version: 2, Version supported: 1
main - Mode detected: sahara
sahara -
Version 0x2
------------------------
HWID:             0x001350e100290875 (MSM_ID:0x001350e1,OEM_ID:0x0029,MODEL_ID:0x0875)
CPU detected:     "lahaina"
PK_HASH:           0x0e172e7799ab2674eacaee35e098e8b505ae768f7a2418ca653abecbe02198c3e3993a98b34fd8ecbb971c0c8b770e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Serial:           0x4dcc2414

sahara - Detected loader: /data/develop/android/edl/edlclient/../Loaders/asus_wingtech/001350e100290875_0e172e7799ab2674_fhrpg.bin
sahara - Protocol version: 2, Version supported: 1
sahara - Uploading loader /data/develop/android/edl/edlclient/../Loaders/asus_wingtech/001350e100290875_0e172e7799ab2674_fhrpg.bin ...
sahara - 64-Bit mode detected.
sahara - Firehose mode detected, uploading...
sahara - Loader successfully uploaded.
main - Trying to connect to firehose loader ...
firehose - INFO: Binary build date: Aug 13 2021 @ 23:00:54
firehose - INFO: Binary build date: Aug 13 2021 @ 23:00:54
firehose - INFO: Chip serial num: 1305224212 (0x4dcc2414)
firehose - INFO: Supported Functions (15):
...
firehose - INFO: UFS Inquiry Command Output: SAMSUNG KLUDG4UHDC-B0E1 0100
[ OmniRom 14 Dev - xtrnaw7@t15g /data/develop/android/edl ] $

To test, if the access via edl is working, use one of the edl commands to read data from the phone, e.g
Code:
./edl getactiveslot

Code:
[ OmniRom 14 Dev - xtrnaw7@t15g /data/develop/android/edl ] $ ./edl getactiveslot
Qualcomm Sahara / Firehose Client V3.62 (c) B.Kerler 2018-2023.
main - Trying with no loader given ...
main - Waiting for the device
main - Device detected :)
main - Mode detected: firehose
Current active slot: b
[ OmniRom 14 Dev - xtrnaw7@t15g /data/develop/android/edl ] $


See the documentation for the edl tool for what you can do in EDL mode.


If everything is done, exit the EDL mode using the command:

Code:
./edl reset

or, if that does not work :

Press the buttons VolumeUp and VolumeDown and Power together for at least 10 seconds.


Trouble Shooting



"adb reboot edl" does not work with all OS available for the ASUS Zenfone 8:


ROM"adb reboot edl" works?Comment
ASUS Android 13yes
OmniROM 13yes
OmniROM 14yes
LineageOS 19
no
the phone boots into the Android OS after executing "adb reboot edl"

Booting into EDL mode via adb does also not work if the phone is booted into the recovery

Booting via adb into the EDL mode works if the phone is booted from the TWRP image file.
LineageOS 20nothe phone boots into the Android OS after executing "adb reboot edl"

Booting into EDL mode via adb does also not work if the phone is booted into the recovery

Booting via adb into the EDL mode also does not work if the phone is booted from the TWRP image file created for the LineageOS (see here)
LineageOS 21 (unofficial build!)yesOS image downloaded from here:
https://github.com/mikooomich/android_device_asus_sake/releases
/e/nothe phone boots into the Android OS after executing "adb reboot edl"

Booting into EDL mode via adb does also not work if the phone is booted into the recovery

Booting via adb into the EDL mode also does not work if the phone is booted from the TWRP image file created for the StatiXOS (see here)
StatiXOSnothe phone boots into the Android OS after executing "adb reboot edl"
LMODroidnothe phone boots into the Android OS after executing "adb reboot edl"
TWRP 3.7.1_12-0yes


The "special" TWRP images created for LineageOS and the other OS are build using the ramdisk from TWRP and the kernel from the original OS. So I guess booting into EDL mode is a feature of the kernel that is not enabled in these kernel.



Physically booting the ASUS Zenfone 8 into the EDL mode

If there is an OS installed on the phone that does not support booting into the EDL mode via adb command, the phone must be booted physically into the EDL mode

The instructions how to do that are printed by the edl script:

main - Hint: Press and hold vol up+dwn, connect usb. For some, only use vol up.

With the help of aunt google I found these more detailed working instructions:

  1. power off the phone using the PowerOff entry in the Bootloader menu
  2. wait until the phone is really powered off
  3. disconnect the phone from the PC
  4. Hold volume up and volume down at the same time
  5. start edl on the PC
  6. connect the phone to the PC while holding down both buttons
  7. release both buttons when the screen is black again (after at least 5 seconds)

But this works only partially on the ASUS Zenfone 8 :

The phone is now visible with a different vendor id and a different product it:

Code:
[ OmniRom 14 Dev - xtrnaw7@t15g /data/develop/android/scripts_on_linux ] $ lsusb | grep Qual
Bus 003 Device 012: ID 05c6:f000 Qualcomm, Inc. TA-1004 [Nokia 8]
[ OmniRom 14 Dev - xtrnaw7@t15g /data/develop/android/scripts_on_linux ] $

These USB IDs are not yet configured in the file with the udev rules for the EDL mode /etc/udev/rules.d/51-edl.rules :

Code:
[ OmniRom 14 Dev - xtrnaw7@t15g /data/develop/android/scripts_on_linux ] $ grep 05c6 /etc/udev/rules.d/51-edl.rules 
SUBSYSTEMS=="usb", ATTRS{idVendor}=="05c6", ATTRS{idProduct}=="9008", MODE="0666", GROUP="plugdev"
SUBSYSTEMS=="usb", ATTRS{idVendor}=="05c6", ATTRS{idProduct}=="9006", MODE="0666", GROUP="plugdev"
SUBSYSTEMS=="usb", ATTRS{idVendor}=="05c6", ATTRS{idProduct}=="900E", MODE="0666", GROUP="plugdev"
[ OmniRom 14 Dev - xtrnaw7@t15g /data/develop/android/scripts_on_linux ] $

Therefore EDL started as non-root user can not detect the phone.

To fix this issue, add the new USB ids to the file /etc/udev/rules.d/51-edl.rules :

Code:
cp /etc/udev/rules.d/51-edl.rules $HOME/51-edl.rules.org

echo 'SUBSYSTEMS=="usb", ATTRS{idVendor}=="05c6", ATTRS{idProduct}=="f000", MODE="0666", GROUP="plugdev"' | sudo tee -a /etc/udev/rules.d/51-edl.rules 

[ OmniRom 14 Dev - xtrnaw7@t15g /data/develop/android/scripts_on_linux ] $ grep 05c6 /etc/udev/rules.d/51-edl.rules 
SUBSYSTEMS=="usb", ATTRS{idVendor}=="05c6", ATTRS{idProduct}=="9008", MODE="0666", GROUP="plugdev"
SUBSYSTEMS=="usb", ATTRS{idVendor}=="05c6", ATTRS{idProduct}=="9006", MODE="0666", GROUP="plugdev"
SUBSYSTEMS=="usb", ATTRS{idVendor}=="05c6", ATTRS{idProduct}=="900E", MODE="0666", GROUP="plugdev"
SUBSYSTEMS=="usb", ATTRS{idVendor}=="05c6", ATTRS{idProduct}=="f000", MODE="0666", GROUP="plugdev"
[ OmniRom 14 Dev - xtrnaw7@t15g /data/develop/android/scripts_on_linux ] $ 

sudo udevadm control --reload
sudo udevadm trigger

But even with the correct udev rules the phone is not detected by the edl tool. This is not an EDL mode. Most probably ASUS disabled switching to the EDL mode using the physical buttons in the firmware.

Conclusion:

The only way to boot an ASUS Zenfone 8 with one of the crippled operating systems into EDL mode is to use the special USB cable to boot into EDL mode (see for example here),



If an error occurs when using the edl tool, first check whether the error is already mentioned in a problem in the repository's problem list : https://github.com/bkerler/edl/issues


The python script edl writes debug messages if executed with the parameter --debugmode.

The parameter --debugmode only works if the directory logs exists in the current working directory and the current user can write to this directory. The debug messages are then in the file ./logs/log.txt.


The ASUS Zenfone 8 can not be booted into the EDL mode via fastboot (at least in my environment with Fedora 39)


Code:
[ OmniRom 14 Dev - xtrnaw7@t15g /data/develop/android/edl ] $  ./edl reset
Qualcomm Sahara / Firehose Client V3.62 (c) B.Kerler 2018-2023.
main - Trying with no loader given ...
main - Waiting for the device
main - Device detected :)
main - Mode detected: firehose
DeviceClass - USBError(19, 'No such device (it may have been disconnected)')
[ OmniRom 14 Dev - xtrnaw7@t15g /data/develop/android/edl ] $


The error message after doing a edl reset seems to be normal and not an error.

The reason of the error message

Code:
[ OmniRom 14 Dev - xtrnaw7@t15g /data/develop/android/edl ] $ ./edl --loader=./prog_firehose_ddr.elf  printgpt 
Qualcomm Sahara / Firehose Client V3.62 (c) B.Kerler 2018-2023.
main - Using loader ./prog_firehose_ddr.elf ...
main - Waiting for the device
DeviceClass
DeviceClass - [LIB]: Couldn't get device configuration.
.DeviceClass

was in my environment the missing udev rules file.


It seems, that not all firehole loader support all commands:

Code:
[ OmniRom 14 Dev - xtrnaw7@t15g /data/develop/android/edl ] $ ./edl pbl ./primary_boot_loader
Qualcomm Sahara / Firehose Client V3.62 (c) B.Kerler 2018-2023.
main - Trying with no loader given ...
main - Waiting for the device
main - Device detected :)
main - Mode detected: firehose
firehose_client
firehose_client - [LIB]: Peek command isn't supported by edl loader
[ OmniRom 14 Dev - xtrnaw7@t15g /data/develop/android/edl ] $

The command

Code:
./edl getstorageinfo

prints the list of supported functions, e.g.:

Code:
[ OmniRom 14 Dev - xtrnaw7@t15g /data/develop/android/edl ] $ ./edl --loader=asus_firehose/firehose/prog_firehose_ddr.elf   getstorageinfo
Qualcomm Sahara / Firehose Client V3.62 (c) B.Kerler 2018-2023.
main - Using loader asus_firehose/firehose/prog_firehose_ddr.elf ...
main - Waiting for the device
......
main - Hint:   Press and hold vol up+dwn, connect usb. For some, only use vol up.
main - Xiaomi: Press and hold vol dwn + pwr, in fastboot mode connect usb.
       Run "./fastpwn oem edl".
main - Other:  Run "adb reboot edl".
   
......main - Device detected :)
sahara - Protocol version: 2, Version supported: 1
main - Mode detected: sahara
sahara -
Version 0x2
------------------------
HWID:              0x001350e100290875 (MSM_ID:0x001350e1,OEM_ID:0x0029,MODEL_ID:0x0875)
CPU detected:      "lahaina"
PK_HASH:           0x0e172e7799ab2674eacaee35e098e8b505ae768f7a2418ca653abecbe02198c3e3993a98b34fd8ecbb971c0c8b770e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Serial:            0x4dcc2414
   
sahara - Protocol version: 2, Version supported: 1
sahara - Uploading loader asus_firehose/firehose/prog_firehose_ddr.elf ...
sahara - 64-Bit mode detected.
sahara - Firehose mode detected, uploading...
sahara - Loader successfully uploaded.
main - Trying to connect to firehose loader ...
firehose - INFO: Binary build date: Aug 13 2021 @ 23:00:54
firehose - INFO: Binary build date: Aug 13 2021 @ 23:00:54
firehose - INFO: Chip serial num: 1305224212 (0x4dcc2414)
firehose - INFO: Supported Functions (15):
firehose - INFO: program
firehose - INFO: read
firehose - INFO: nop
firehose - INFO: patch
firehose - INFO: configure
firehose - INFO: setbootablestoragedrive
firehose - INFO: erase
firehose - INFO: power
firehose - INFO: firmwarewrite
firehose - INFO: getstorageinfo
firehose - INFO: benchmark
firehose - INFO: emmc
firehose - INFO: ufs
firehose - INFO: fixgpt
firehose - INFO: getsha256digest
firehose - INFO: End of supported functions 15
firehose_client
...

Running edl with sudo only works if the tool has been installed and configured as root user (and this is not necessary and explicitly NOT recommended)


There are various reasons to get an error message like this:

Code:
[ OmniRom 14 Dev - xtrnaw7@t15g /data/develop/android/edl ] $ ./edl getstorageinfo
Qualcomm Sahara / Firehose Client V3.62 (c) B.Kerler 2018-2023.
main - Trying with no loader given ...
main - Waiting for the device
main - Device detected :)
main - Mode detected: sahara
Traceback (most recent call last):
 File "/data/develop/android/edl/./edl", line 393, in <module>
 base.run()
 File "/data/develop/android/edl/./edl", line 295, in run
 version = conninfo["data"].version
 ^^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: type object 'req' has no attribute 'version'
[ OmniRom 14 Dev - xtrnaw7@t15g /data/develop/android/edl ] $

To fix it:

- use an USB 2.0 port and not an USB 3.x port

- try the access using a different USB cable

- in my environment these instructions work:

execute the commands to access the phone via edl in this order:

1. boot the phone into the Android OS with enabled access via adb

2. open a terminal and start edl :

Code:
./edl --loader=/data/backup/ASUS_ZENFONE8/edl/prog_firehose_ddr.elf

(the script then complains that no phone was found in edl mode, but it waits until it finds one)

3. open another terminal and reboot the phone into the edl mode:

Code:
adb reboot edl