When I’d bought this 1020 in question, I picked it up from an AT&T customer with the intention of basically using it as a camera.  Well it was kind of okay but it had been upgraded to Windows 10, which technically is unsupported on the 1020 hardware.  And no wonder as the 1020 specific camera applications aren’t available, nor is performance all that great on Windows 10.  I’m guessing there is a laundry list of reasons of why Windows 10 was not available for the 1020.

So I saw this website, lumiafirmware.com that not only has an incredible amount of firmware saved, but it sure makes the process of loading different firmware pretty simple.

• Install “Windows Device Recovery Tool” http://go.microsoft.com/fwlink/?LinkID=525569
• Download the firmware form this site only the ffu.
• And now open CMD as administrator
• Type “cd C:\Program Files (x86)\Microsoft Care Suite\Windows Device Recovery Tool” / (32 bit pc) “cd C:\Program Files\Microsoft Care Suite\Windows Device Recovery Tool”
• Connect now your phone to your pc
• Type in cmd “thor2 -mode uefiflash -ffufile “C:\the location of the ffu\file name.ffu” -do_full_nvi_update -do_factory_reset”
• Wait now until your phone gives a green screen
• Type now in cmd “thor2 -mode rnd -bootnormalmode”

Really doesn’t that sound not that difficult at all?!

Except it wasn’t.

Looking at the incredibly extensive list, I see that the AT&T 1020 phone in yellow colour is the RM877.  So I download the appropriate ffu image and run:

thor2 -mode uefiflash -ffufile RM877_3051.50009.1451.1_RETAIL_nam_att_205_01_473928_prd_signed.ffu -do_full_nvi_update -do_factory_reset

A bunch of verbose output happens and then:

Start sending payload data V2Sbl in async mode...
Percents: 0
Device responded a message that has invalid size!
Expected: 16, Received: 0
Exception during programming: 262150
Safe write descriptor index reached: false
Payload data transfer speed (0.22 MB/s) Elapsed time 40.83 sec
Payload data size 9.000123 MB
[IN] programSecureFfuFile. Closing RM877_3051.50009.1451.1_RETAIL_nam_att_205_01_473928_prd_signed.ffu
programming operation failed!
Operation took about 1 minute, 6 seconds. Average transfer speed was 0.11 MB/s.

Unknown error code.

THOR2 1.8.2.18 exited with error code 262150 (0x40006)

Unknown error code!  What the hell does that mean?

Glancing over at the phone I’ll show you what it means.

So the phone was stuck at the red screen waiting to be programmed, but obviously that failed.  Re-running the programmer just gave me this:

Detecting UEFI responder
Send HELLO
Send HELLO
Send HELLO
Send HELLO
Send HELLO
Lumia UEFI Application did not respond to version info query
Device is not in Lumia UEFI mode
Reading device mode failed
Failed to detect UEFI responder. 84017

THOR2_ERROR_TO_COMMUNICATE_WITH_DEVICE

THOR2 1.8.2.18 exited with error code 84102 (0x14886)

So I thought I’d hold down the volume down button & power and do a reset.  Except now my device was nearly bricked.  The display wouldn’t turn on at all, and there was no haptic feedback on powering up and or down.

HOWEVER plugging in the USB would make the connection noise, and how me a “QHSUSB_DLOAD” device.  So I could try to talk to it in emergency mode.

Apparently on the same download page, there is a hex file and a mbn file.  Downloading those and running:

thor2 -mode emergency -hexfile FAST8960_EOS_NAM.hex -mbnfile RM877_msimage_v1.0.mbn -orig_gpt

And this looked like it was going to work… but then as always it failed.

Sending OPEN_MULTI_REQ
Received valid response to OPEN_MULTI_REQ
Programming image R
Image opened successfully for reading
SAFE hex file was used and unallowed memory address was being written.
Reset the device and use the correct HEX file.
ALPHA EMERGENCY FLASH END
Emergency messaging closed successfully
Operation took about 11.00 seconds.

Unknown error code.

THOR2 1.8.2.18 exited with error code 85034 (0x14C2A)

Use the correct HEX file? But it was the one that I downloaded from the right page!  Great now my phone is dead.  Unplugging it in and out however gives me a little hope as it’s still showing up as a QHSUB_DLOAD device.

After a lot of searching I see Joemar Serrato went down the same road, and they did something weird where they split out the mbnfile from the ffu file themselves.  So I ran the following command to split out the mbn files:

thor2 -mode ffureader -ffufile RM877_3045.0000.1325.0001_RETAIL_nam_att_205_01_223461_prd_signed.ffu -dump_gpt -filedir gpt

And now I had 2 files.

10/04/2018  06:53 PM            17,408 GPT0.bin
10/04/2018  06:53 PM            17,408 GPT1.bin

Now with all that drama I could re-run the emergency mode flash

thor2 -mode emergency -hexfile FAST8960_EOS_NAM.hex -mbnfile gpt\GPT0.bin -orig_gpt

Sending OPEN_MULTI_REQ
Received valid response to OPEN_MULTI_REQ
Programming image g
Image opened successfully for reading
Uploading MBN image 70
SAFE hex file was used and unallowed memory address was being written.
Reset the device and use the correct HEX file.
ALPHA EMERGENCY FLASH END
Emergency messaging closed successfully
Operation took about 11.00 seconds.

Unknown error code.

THOR2 1.8.2.15 exited with error code 85034 (0x14C2A)

And it appeared nothing changed at all. Great.  In disgust I unplug the phone and hold down the volume down & power button for 15 seconds, but this time it vibrated.  I couldn’t believe it!  Within a few seconds it powered back up to the red screen, ready to load new firmware!

thor2 -mode uefiflash -ffufile RM877_3045.0000.1325.0001_RETAIL_nam_att_205_01_223461_prd_signed.ffu -do_full_nvi_update -do_factory_reset

Size of system mem: 2097152 KB
Send backup to RAM req...
Clearing the backup GPT...SKIPPED!
Successfully parsed FFU file. Header size: 0x000c0000, Payload size: 0x00000000572e0000, Chunk size: 0x00020000, Header offset: 0x00000000, Payload offset: 0x00000000000c0000
RKH match between device and FFU file!
Option: Skip CRC32 check in use
Start sending header data…
Start sending payload data V2Sbl in async mode...
Percents: 0
Percents: 1
Percents: 2
Percents: 3
Percents: 4
Percents: 5

I was astonished!  The progress bar was slowly moving, and the phone was doing what it should have been doing about 2 hours ago.  I dared not move, so unfortunately I don’t have any pictures.

Payload data transfer speed (9.79 MB/s) Elapsed time 142.41 sec
Payload data size 1394.893921 MB
Read flashing status..
[IN] programSecureFfuFile. Closing RM877_3045.0000.1325.0001_RETAIL_nam_att_205_01_223461_prd_signed.ffu
Get EMMC write speed...
Get EMMC write speed, SKIPPED!
Get data verify speed...
Get data verify speed, SKIPPED!
Send restore backup from RAM req...
programming operation completed!
[THOR2_flash_state] Post programming operations
[THOR2_flash_state] Executing factory reset
[Factory reset result] 0
Factory reset done
[THOR2_flash_state] Executing Full NVI Update
Write flash options ( WriteNvi: Full )

Write parameter to device via UEFI Flash App
Write parameter Ok
Flash options set successfully.

[Full NVI update result] 0
Operation took about 2 minutes, 24 seconds. Average transfer speed was 10.16 MB/s.

Exited with success

And then just like that, the phone rebooted itself, and then brought itself up to the ‘green screen’

All that remained to do was to tell the phone to boot up normally

thor2 -mode rnd -bootnormalmode

And that was it!

My 1020 is now running 8.0, which includes not only the special Nokia phone apps, but all the AT&T bloatware of 2012.  I can’t believe there was a yellow pages app.  How are they still a thing?