Qualcomm Download Mode 9006

Don't rely on unknown loaders ) The vendor service software is always right!

I'm thinking about firehose/sahara loaders. You can't always get vendor firmware with those, especially not for Samsung or LG devices as they're for internal use only 😉

To actually make a dump from this mode a correct loader is required, nowhere to be found publicly.

Available since model is released, sadly it's DMSS streaming download and it's very slow.

But, since these phones even now come up for extraction, I may up put those loaders for rest of the "public".

https://drive.google.com/file/d/1Ozo3qYV-wF-EfJ6iC6lCDXIL-z1RgnO4/view?usp=sharing

This will work only with i9505, not with the US/CA counterparts.
I have also some other S4 models loaders, can provide on request.

On how to use it, simplest way I can think of now is

1. Enter EDL by shorting CMD or CLK to GND
2. QPST->emmcswdownload ->qfuses -> select hex file ->send image
3. Close QPST from taskbar to release port
4. RIFF JTAG Manager -> USB TAB -> set "Streaming download protocol" (other irrelevant as phone is booted)
5. Click "Check Memory" - tick auto fullflash, click read memory.

Edit

I had one working board here and after testing this method wont work, for simple reason that reading is not compiled into loader. So, it's just good for writes, and building and uploading msimage didnt resulted with success, phone didnt entered 9006 mass storage mode.

So we have an LG Rebel 4 from Tracfone (same as LG Aristo 2, LG Aristo 2 Plus, LG Phoenix 4, etc. all the x210 models and x212).
We found the test point to short to get the phone into 9008 mode.
We cannot find any programmer (mbn/firehose) publicly, but there are FRP unlocks and various code unlock exploits for the various other models.
Any idea how to get one of these into 9006 mode? I created an 8917_msimage.mbn but cannot flash it without a programmer (hex or firehose). I don't see a JTAG interface anywhere even though we do have a test point.

Motherboard photos https://slickdeals.net/f/12870790-simple-mobile-rebel-4-l211vl-black-12-99-at-best-buy?p=125854501#post125854501
9008 test point (see area circled in the next post #229)

Any help would be appreciated in locating the JTAG port, or giving ideas on how to either flash or download the current image.