This guide has been written originally by Ivan Alex HC
This guide was provided by Victor C. on Google Groups, that wanted to share a quick write-up on accessing EDL where button combinations / USB cable don't work (since "access ELD mode" is not always simple), using its Canadian carrier-branded Alcatel A405DL. It's not exactly the same as US unlocked A405DL so none of other methods worked for EDL. And for him EDL was required to do "userdata" partition read / write with CAT B35 firehose like others have successfully done in the previous tests (see above).
For Victor, this method will work for most Qualcomm chipsets that support EDL, as long as manufacturer wired EDL pin somewhere on the board, sure that most of them have it since this undocumented feature helps should be needed to remove the back cover, find the ground, keep shortening different test-points to the ground until you find the one that triggers EDL mode. There is a slight risk of damaging the phone.
So, let go see the detailed steps!
¶ Use testpoints to access EDL
-
Remove battery and rear cover of the phone exposing various test points. Connect phone to the computer with USB cable. Run a repetitive probe of usb devices list. In linux it can be infinte bash loop: "
while true; do lsusb; sleep 1; done"; -
Find a ground point which is any large piece of metal e.g. sim card socket, sd card socket, RF shielding etc. Prepare two probes shorted to each other or a stiff thin wire. Multimeter with leads connected to a 10A socket of the multimeter is the best option as it's also allowing you to see when you short some wrong pins;
-
The phone will be rebooting on it's own while plugged into USB (if yours doesn't then you need to boot it by hand each time you try a new test-point). Go ahead and short different test-points to the ground one-by-one and observe boot behavior. Depending on which test point you short to the ground you can see:
-
a) Multimeter shows nothing, "lsusb" shows nothing, phone keeps rebooting - move to the next test-point
-
b) Multimeter shows nothing, "lsusb" shows nothing, phone does not boot - move to the next test point
-
c) Multi meter shows current of a few 100's mA, phone does not boot - remove your leads ASAP, as you a shorting a power line and risk damaging the phone. Move to the next test-point
-
d) Multimeter shows nothing, "lsusb" starts showing device ID "05c6:9008" - congratulations you are in EDL mode
....
- z) something else happens and you phone no longer boots - sorry, for the next KaiOS phone you may want something that supports apps side-loading
- Once you determine correct test-point for edl, you may want to drill a small hole in the back cover around the same place so you can keep it accessible with cover on the phone. Pictures illustrating EDL testpoints on A405DL:
- Once you know how to get into edl, use a matching firehose, edl․py to read / write "userdata" partition.