Palm PVG100 flasher

The zip is an update package: it holds the system in a compressed form that only a running phone can install. ota2raw turns that into the plain images a first install needs, and checks each one against a known checksum. It prints verified for each image.

The edl folder has one converter per kind of computer. Run the one that matches yours.

cd lineage-pepito/edl
chmod +x ota2raw-linux-x86_64
./ota2raw-linux-x86_64

cd lineage-pepito/edl
xattr -dr com.apple.quarantine .
chmod +x ota2raw-macos-arm64
./ota2raw-macos-arm64

Afterwards the edl folder contains boot.bin, recovery.bin, system.bin and vendor.bin next to the two loaders (pvg100_firehose.elf, pvg100e_firehose.elf). Those are the files this page reads. The other files in the folder are for the command-line method and are ignored here.

Every known firmware for this phone, stock and third-party, is listed in the XDA firmware thread.

This page can flash any of them, within what it writes. The folder you choose must contain boot, recovery, system and vendor images, named boot.bin or boot.img and so on.

The images must be raw, not Android "sparse" images. This page refuses a sparse image; convert it first with simg2img.

Only those four partitions are written, plus the boot logo at the start of splash when the folder has a splash.bin, and config is cleared. A stock firmware package also carries the bootloader, modem and other firmware; this page leaves those as they are. To put a phone fully back to stock, restore your own backup on the Restore tab.

Each release has two zips. Take one, not both:

• the plain one: LineageOS with no Google apps;
• the one with gapps in its name: the same build with Google apps and the Play Store.

The same zip is also the update package. A phone that already runs this LineageOS does not need this page: its built-in Updater installs the zip directly.

To check the download is intact, fetch the matching .sha256sum file into the same folder and run sha256sum -c lineage-24.0-*.zip.sha256sum.

Ticking the box installs boot-magisk.bin, this build's boot image with Magisk already patched in. Root is optional and unsupported.

• You cannot make your own by patching boot.bin in the Magisk app. The result is unsigned and the phone hangs at the PALM logo.
• After the first boot, install the Magisk app and let it finish its "additional setup".
• Never use Magisk's Direct Install to update. It breaks the boot image, and the only fix is to flash again from this page.
• Switching between rooted and unrooted later keeps your data: flash again with the box changed.

EDL (emergency download, also called 9008 mode) is a mode built into the phone's chip. The screen is black and the phone looks dead; that is normal. There are three ways in.

1. From recovery

Hold the power button down through three restarts, until "Entering Recovery Mode" appears. Then:

• LineageOS recovery: choose Advanced, then Reboot to EDL. The menu works by touch or with the power button.
• Stock recovery: choose Emergency Download Mode in the main menu. Use the power button: a short press moves down, a long press selects.

From stock recovery:

Watch the video on YouTube

2. With adb

1. Open Settings, About phone, and tap Build number seven times to unlock Developer options.
2. In Developer options, turn on USB debugging.
3. Plug the phone into the computer and accept the "Allow USB debugging?" prompt on the phone.
4. Run adb reboot edl.

adb comes with Google's platform-tools. It works from Android and from recovery.

3. With an EDL cable

An EDL cable (also sold as a "deep flash cable") is a USB cable with a button on it. It works on a phone that will not start at all.

1. Turn the phone off: hold the power button for about 15 seconds.
2. Hold the cable's button down and plug the cable into the phone.
3. Let go of the button after a few seconds.

Watch the video on YouTube

Checking it worked

• Linux: lsusb lists a Qualcomm device with ID 05c6:9008.
• macOS: System Information, USB, shows QUSB_BULK.
• Windows: Device Manager shows a Qualcomm 9008 device or QUSB_BULK.

Getting out again

Press "Restart the phone" once connected, or hold the power button for about 15 seconds. Leaving EDL without flashing changes nothing on the phone.

Use a plain USB cable plugged straight into the computer. Hubs and magnetic adapters drop connections.

• PVG100: the US (Verizon) model.
• PVG100E: the international (Vodafone) model.

The model number is printed on the label on the back of the phone and on the box. Stock Android shows it under Settings, System, About phone, Model.

Both models take the same build, but each only accepts its own loader and they lay out storage differently. If you pick the wrong one the phone refuses the loader, or this page stops at the partition check. Either way nothing is written.

echo 'SUBSYSTEM=="usb", ATTR{idVendor}=="05c6", ATTR{idProduct}=="9008", TAG+="uaccess"' | sudo tee /etc/udev/rules.d/70-qualcomm-edl.rules
sudo udevadm control --reload-rules

for d in /sys/bus/usb/drivers/qcserial/*-*; do echo "${d##*/}" | sudo tee /sys/bus/usb/drivers/qcserial/unbind; done

Windows: the phone must use the WinUSB driver, not the Qualcomm 9008 serial driver. Zadig can switch it. The command-line qdl method needs the serial driver instead, so switch it back if you change methods.

Nothing in the list after pressing Connect: the phone is not in EDL mode, or the cable carries power only. Check with the steps under "Ways to get into EDL mode".

If a step fails part-way, hold power for about 15 seconds, re-enter EDL mode and reload this page.

The backup is a new folder named palm-<model>-backup-<date> inside the folder you choose. It contains:

• one .bin file per partition, about 50 in all;
• gpt-lun0.bin, the partition table;
• rawprogram_restore.xml, the list a restore tool needs to put each file back.

Some of these files exist nowhere else. modemst1, modemst2, fsg, persist, sec and traceability hold this phone's own radio calibration and identity. Without them a phone cannot be returned to working stock firmware.

Your personal data (userdata) is left out. It is most of the storage, it is encrypted, and it cannot be read back on a phone that has been reflashed.

Restoring is done on the Restore tab. The qdl command-line tool can also do it, with the phone in EDL mode, from the folder that holds the loader:

qdl --storage emmc --include palm-pvg100-backup-DATE pvg100_firehose.elf palm-pvg100-backup-DATE/rawprogram_restore.xml

On a PVG100E use pvg100e_firehose.elf.

Copy the finished folder somewhere safe.

The whole partition, byte for byte, in a file named after it, such as modemst1.bin. That is the same file a full backup holds, so the Restore and Flash (advanced) tabs take it back as it is. "Partition table" saves gpt-lun0.bin, the first 34 sectors of the storage.

userdata is most of the storage, over 20 GB, and encrypted: a copy cannot be read on another phone, or on this one once it has been reflashed.

A file is matched to a partition by its name: boot.bin or boot.img goes to boot, modemst1.bin to modemst1. Files must be raw images no larger than their partition, not Android "sparse" images (convert those with simg2img). Other files in the folder are ignored. A whole backup is about 8 GB and takes longer than a flash. Your personal data (userdata) is never written.

If the folder holds a gpt-lun0.bin or traceability.bin, they must match this phone, or nothing is written: the folder is a backup of a different phone.

After restoring stock firmware, the data LineageOS left behind cannot be read by stock Android. If the phone stays on the boot logo or asks to reset, open stock recovery (hold the power button down through three restarts) and choose Wipe data/factory reset. It erases everything on the phone.

The restore stopped part-way: leave the phone connected and press Restore again. If the page lost the connection, put the phone back into EDL mode, reload this page and start again. A phone whose bootloader is only half-written goes into EDL mode on its own when switched on; failing that, an EDL cable always works.

Why some partitions need proof: traceability, modemst1, modemst2, fsg, ssd, persist, tunning, simlock and DDR belong to one phone: its identity, radio and sensor calibration. Writing another phone's would give this one the other's identity and a radio tuned for different hardware.

The file is written from the start of the partition. A file smaller than the partition leaves the rest of it as it was. Nothing else on the phone is touched. Images may be named anything; if the name matches a partition, such as aboot.img or modemst1.bin, that partition is chosen for you.

Bootloader partitions (sbl1, aboot, rpm, tz and others): a wrong image stops the phone from starting. It then goes into EDL mode on its own, or with an EDL cable, so it can be rewritten here.

Per-phone partitions (traceability, modemst1, modemst2, fsg, ssd, persist, tunning, simlock, DDR) hold this phone's own identity and calibration. Only write a copy taken from this same phone. Another phone's copy gives this one its identity and a radio tuned for different hardware. The page asks you to type the partition's name before writing one. The Restore tab can check a whole backup's origin; this tab cannot.

The first boot takes a few minutes. Leave the phone alone while the boot logo animates.

Black screen for more than five minutes: put the phone back into EDL mode and flash again. Flashing twice does no harm.

The flash stopped part-way: leave the phone connected and press Flash again. If the page lost the connection, hold power for about 15 seconds, re-enter EDL mode, reload this page and choose the folder again.