When I’d bought this 1020 in question, I picked it up from an AT&T customer with the intention of basically using it as a camera. Well it was kind of okay but it had been upgraded to Windows 10, which technically is unsupported on the 1020 hardware. And no wonder as the 1020 specific camera applications aren’t available, nor is performance all that great on Windows 10. I’m guessing there is a laundry list of reasons of why Windows 10 was not available for the 1020.
So I saw this website, lumiafirmware.com that not only has an incredible amount of firmware saved, but it sure makes the process of loading different firmware pretty simple.
- Install “Windows Device Recovery Tool” http://go.microsoft.com/fwlink/?LinkID=525569
- Download the firmware form this site only the ffu.
- And now open CMD as administrator
- Type “cd C:\Program Files (x86)\Microsoft Care Suite\Windows Device Recovery Tool” / (32 bit pc) “cd C:\Program Files\Microsoft Care Suite\Windows Device Recovery Tool”
- Connect now your phone to your pc
- Type in cmd “thor2 -mode uefiflash -ffufile “C:\the location of the ffu\file name.ffu” -do_full_nvi_update -do_factory_reset”
- Wait now until your phone gives a green screen
- Type now in cmd “thor2 -mode rnd -bootnormalmode”
Really doesn’t that sound not that difficult at all?!
Except it wasn’t.
Looking at the incredibly extensive list, I see that the AT&T 1020 phone in yellow colour is the RM877. So I download the appropriate ffu image and run:
thor2 -mode uefiflash -ffufile RM877_3051.50009.1451.1_RETAIL_nam_att_205_01_473928_prd_signed.ffu -do_full_nvi_update -do_factory_reset
A bunch of verbose output happens and then:
Start sending payload data V2Sbl in async mode... Percents: 0 Device responded a message that has invalid size! Expected: 16, Received: 0 Exception during programming: 262150 Safe write descriptor index reached: false Payload data transfer speed (0.22 MB/s) Elapsed time 40.83 sec Payload data size 9.000123 MB [IN] programSecureFfuFile. Closing RM877_3051.50009.1451.1_RETAIL_nam_att_205_01_473928_prd_signed.ffu programming operation failed! Operation took about 1 minute, 6 seconds. Average transfer speed was 0.11 MB/s. Unknown error code. THOR2 22.214.171.124 exited with error code 262150 (0x40006)
Unknown error code! What the hell does that mean?
Glancing over at the phone I’ll show you what it means.
So the phone was stuck at the red screen waiting to be programmed, but obviously that failed. Re-running the programmer just gave me this:
Detecting UEFI responder Send HELLO Send HELLO Send HELLO Send HELLO Send HELLO Lumia UEFI Application did not respond to version info query Device is not in Lumia UEFI mode Reading device mode failed Failed to detect UEFI responder. 84017 THOR2_ERROR_TO_COMMUNICATE_WITH_DEVICE THOR2 126.96.36.199 exited with error code 84102 (0x14886)
So I thought I’d hold down the volume down button & power and do a reset. Except now my device was nearly bricked. The display wouldn’t turn on at all, and there was no haptic feedback on powering up and or down.
HOWEVER plugging in the USB would make the connection noise, and how me a “QHSUSB_DLOAD” device. So I could try to talk to it in emergency mode.
Apparently on the same download page, there is a hex file and a mbn file. Downloading those and running:
thor2 -mode emergency -hexfile FAST8960_EOS_NAM.hex -mbnfile RM877_msimage_v1.0.mbn -orig_gpt
And this looked like it was going to work… but then as always it failed.
Sending OPEN_MULTI_REQ Received valid response to OPEN_MULTI_REQ Programming image R Image opened successfully for reading SAFE hex file was used and unallowed memory address was being written. Reset the device and use the correct HEX file. ALPHA EMERGENCY FLASH END Emergency messaging closed successfully Operation took about 11.00 seconds. Unknown error code. THOR2 188.8.131.52 exited with error code 85034 (0x14C2A)
Use the correct HEX file? But it was the one that I downloaded from the right page! Great now my phone is dead. Unplugging it in and out however gives me a little hope as it’s still showing up as a QHSUB_DLOAD device.
After a lot of searching I see Joemar Serrato went down the same road, and they did something weird where they split out the mbnfile from the ffu file themselves. So I ran the following command to split out the mbn files:
thor2 -mode ffureader -ffufile RM877_3045.0000.1325.0001_RETAIL_nam_att_205_01_223461_prd_signed.ffu -dump_gpt -filedir gpt
And now I had 2 files.
10/04/2018 06:53 PM 17,408 GPT0.bin 10/04/2018 06:53 PM 17,408 GPT1.bin
Now with all that drama I could re-run the emergency mode flash
thor2 -mode emergency -hexfile FAST8960_EOS_NAM.hex -mbnfile gpt\GPT0.bin -orig_gpt
Sending OPEN_MULTI_REQ Received valid response to OPEN_MULTI_REQ Programming image g Image opened successfully for reading Uploading MBN image 70 SAFE hex file was used and unallowed memory address was being written. Reset the device and use the correct HEX file. ALPHA EMERGENCY FLASH END Emergency messaging closed successfully Operation took about 11.00 seconds. Unknown error code. THOR2 184.108.40.206 exited with error code 85034 (0x14C2A)
And it appeared nothing changed at all. Great. In disgust I unplug the phone and hold down the volume down & power button for 15 seconds, but this time it vibrated. I couldn’t believe it! Within a few seconds it powered back up to the red screen, ready to load new firmware!
thor2 -mode uefiflash -ffufile RM877_3045.0000.1325.0001_RETAIL_nam_att_205_01_223461_prd_signed.ffu -do_full_nvi_update -do_factory_reset
Size of system mem: 2097152 KB Send backup to RAM req... Clearing the backup GPT...SKIPPED! Successfully parsed FFU file. Header size: 0x000c0000, Payload size: 0x00000000572e0000, Chunk size: 0x00020000, Header offset: 0x00000000, Payload offset: 0x00000000000c0000 RKH match between device and FFU file! Option: Skip CRC32 check in use Start sending header data… Start sending payload data V2Sbl in async mode... Percents: 0 Percents: 1 Percents: 2 Percents: 3 Percents: 4 Percents: 5
I was astonished! The progress bar was slowly moving, and the phone was doing what it should have been doing about 2 hours ago. I dared not move, so unfortunately I don’t have any pictures.
Payload data transfer speed (9.79 MB/s) Elapsed time 142.41 sec Payload data size 1394.893921 MB Read flashing status.. [IN] programSecureFfuFile. Closing RM877_3045.0000.1325.0001_RETAIL_nam_att_205_01_223461_prd_signed.ffu Get EMMC write speed... Get EMMC write speed, SKIPPED! Get data verify speed... Get data verify speed, SKIPPED! Send restore backup from RAM req... programming operation completed! [THOR2_flash_state] Post programming operations [THOR2_flash_state] Executing factory reset [Factory reset result] 0 Factory reset done [THOR2_flash_state] Executing Full NVI Update Write flash options ( WriteNvi: Full ) Write parameter to device via UEFI Flash App Write parameter Ok Flash options set successfully. [Full NVI update result] 0 Operation took about 2 minutes, 24 seconds. Average transfer speed was 10.16 MB/s. Exited with success
And then just like that, the phone rebooted itself, and then brought itself up to the ‘green screen’
All that remained to do was to tell the phone to boot up normally
thor2 -mode rnd -bootnormalmode
And that was it!
My 1020 is now running 8.0, which includes not only the special Nokia phone apps, but all the AT&T bloatware of 2012. I can’t believe there was a yellow pages app. How are they still a thing?