# Qualcomm Sahara / Firehose Attack Client / Diag Tools
(c) B. Kerler 2018-2021
Guide made By @Jacoa on Telegram

IF YOU ALREADY UNLOCKED YOUR BOOTLOADER YOU CAN JUST RUN "python3 edl w recovery Unlock/twrp.img --memory=ufs --loader=Loaders/0006b0e100310000_2cf7619a278d2607_fhprg_peek.bin" AFTER INSTALLING DRIVERS
Linux Setup:
# Debian/Ubuntu/Mint/etc
- sudo apt install adb fastboot python3-dev python3-pip liblzma-dev git
- sudo apt purge modemmanager
# Fedora/CentOS/etc
- sudo dnf install adb fastboot python3-devel python3-pip xz-devel git

- sudo systemctl stop ModemManager
- sudo systemctl disable ModemManager
- sudo apt purge ModemManager

- sudo cp Drivers/51-edl.rules /etc/udev/rules.d
- sudo cp Drivers/50-android.rules /etc/udev/rules.d
- python setup.py build
- sudo python setup.py install


- Boot device into 9008 mode (https://t.me/LGEV30/601417)

- python edl qfil rawprogram.xml patch.xml Files --memory=ufs

- Hold power and volume down, when the device reboots let go of power and do not let go of volume down (If this does not reboot to fastboot then use adb to reboot to bootloader)

- Run Unlock.sh in Unlock folder

MacOS:
- brew install libusb git

- python setup.py build

- sudo python setup.py install

- boot device into 9008 mode (https://t.me/LGEV30/601417)

- python3 edl qfil rawprogram.xml patch.xml Files --memory=ufs

- Hold power and volume down, when the device reboots let go of power and do not let go of volume down (If this does not reboot to fastboot then use adb to reboot to bootloader)

- run the following commands
	fastboot flash unlock UNLOCK/new_unlock.bin
	fastboot flash recovery twrp.img
	fastboot boot twrp.img

FOR ROOT: Transfer the zips from the ROOT folder to your phone and flash them all in any order

IF TWRP CAN NOT DECRYPT DATA/INTERNAL STORAGE YOU HAVE FOR FORMAT DATA IN THE WIPE SECTION
IF YOU WANT TO FLASH AOSP 10/11 YOU WILL HAVE TO FORMAT DATA IF YOU DID NOT ALREADY


Flash Command:

python edl qfil rawprogram.xml patch.xml Files --memory=ufs

-> to write all files from "files" folder to according partitions

Backup Commands:

Backup everything except userdata, system, and cache
python edl rl Backup --skip=userdata,system,cache --memory=ufs

Backup everything
python edl rl Backup --memory=ufs


All Commands:

edl printgpt --memory=ufs --lun=0 -> to print gpt on lun 0
edl printgpt --memory=ufs -> to print gpt of all lun
edl rf lun0.bin --memory=ufs --lun=0 -> to dump whole lun 0
edl rf flash.bin --memory=ufs -> to dump all luns as lun0_flash.bin, lun1_flash.bin, ...
edl rl dumps --memory=ufs --lun=0 --skip=userdata,vendor_a -> to dump all partitions from lun0 to directory dumps for device with ufs and skip userdata and vendor_a partition
edl rl dumps --memory=ufs --genxml -> to dump all partitions from all lun to directory dumps and write rawprogram[lun].xml
edl rs 0 15 data.bin --memory=ufs --lun=0 -> to dump 15 sectors from starting sector 0 from lun 0 to file data.bin
edl r boot boot.img --memory=ufs --lun=4 -> to dump the partition "boot_a" from lun 4 to the filename boot.img
edl r boot boot.img --memory=ufs -> to dump the partition "boot_a" to the filename boot.img using lun autodetection
edl r boot,recovery boot.img,recovery.img --memory=ufs -> to dump multiple partitions to multiple filenames
edl footer footer.bin --memory=ufs -> to dump the crypto footer
edl w boot boot.img --memory=ufs --lun=4 -> to write boot.img to the "boot" partition on lun 4 on the device with ufs flash
edl w gpt gpt.img --memory=ufs --lun=4 -> to write gpt partition table from gpt.img to the lun 4 on the device with ufs flash
edl wl dumps --memory=ufs --lun=0 -> to write all files from "dumps" folder to according partitions to flash lun 0
edl wl dumps --memory=ufs -> to write all files from "dumps" folder to according partitions to flash and try to autodetect lun
edl wf dump.bin --memory=ufs --lun=0 -> to write the rawimage dump.bin to flash lun 0
edl e misc --memory=ufs --lun=0 -> to erase the partition misc on lun 0
edl gpt . --genxml --memory=ufs -> dump gpt_main[lun].bin/gpt_backup[lun].bin and write rawpartition[lun].xml to current directory (".")
