Tool: EDL (bkerler/edl)
Installed at: tools/opt/edl/ · Run via: tools/edl-run [args]
Programmer Files
| Device | Filename | Path | Notes |
|---|---|---|---|
| Note Air 1 (eMMC) | 000cc0e100000000_7be49b72f9e43372_fhprg_bqx2_peek.bin | tools/opt/edl/Loaders/qualcomm/factory/sdm636/ | Peek variant — also allows memory read/write |
| NA1 fallback | prog_emmc_ufs_firehose_Sdm636_ddr.elf | tools/opt/programmers/ | Standard OEM ELF (622 KB) |
| Note Air 2 (UFS) | 0014d0e100000000_d40eee56f3194665_FHPRG.bin | — | ⚠️ Do NOT use on NA1 |
Key Commands
NA1_LOADER="tools/opt/edl/Loaders/qualcomm/factory/sdm636/000cc0e100000000_7be49b72f9e43372_fhprg_bqx2_peek.bin"
# Print partition table
tools/edl-run --loader="$NA1_LOADER" printgpt
# Dump a partition
tools/edl-run --loader="$NA1_LOADER" r boot /tmp/boot-backup.img
# Flash a partition
tools/edl-run --loader="$NA1_LOADER" w abl builds/abl/abl-v2.4.elf
# Flash multiple co-dependent partitions in ONE invocation
tools/edl-run --loader="$NA1_LOADER" w keymaster,userdata pristine/keymaster.bin,pristine/userdata.bin
# Reset device
tools/edl-run --loader="$NA1_LOADER" resetCritical Hazards
Blacklist qcserial — REQUIRED
On Arch Linux (and other systems), qcserial auto-loads via udev when 05c6:9008 connects. It claims the Sahara interface within ~850ms, consuming the PBL HELLO packet. edl.py then finds the interface empty and times out.
# /etc/modprobe.d/no-qcserial.conf
blacklist qcserialStart edl-run BEFORE plugging in
The PBL sends a Sahara HELLO packet in a narrow ~1–2s window after USB enumeration, then goes silent. Both bulk IN and OUT become unresponsive until the next power cycle. Start tools/edl-run in “waiting for device” state, THEN plug in the USB cable. Do not start edl-run after 9008 is already present.
One write per Sahara session — write co-dependent partitions together
After the first edl-run exits, a second invocation finds the firehose programmer still loaded in a stale state (sector size 512 vs device’s 4096, GPT unreadable). A power cycle is required before the next invocation. However, within a single invocation, multiple partitions can be written safely. Always write co-dependent partitions (e.g., keymaster + userdata) in a single edl-run call. Writing only one and power-cycling leaves FDE broken.
Confirmed Working Operations
| Operation | Status | Notes |
|---|---|---|
| printgpt | ✅ Confirmed | Full partition table dumped 2026-03-16 |
| Partition read (r) | ✅ Confirmed | All partitions backed up, ~29 GB total |
| Partition write (w) | ✅ Confirmed | Used for boot.img (Phase 02), recovery.img (Phase 03), abl.elf (Phase 03a) |
| Peek loader accepted | ✅ Confirmed | fhprg_bqx2_peek.bin accepted |
| reset | ✅ Confirmed | Device reboots cleanly |
| adb reboot edl trigger | ✅ Confirmed | Reliable from Android with ADB access |
| Multi-partition w (comma) | 🔵 Source confirmed | Not yet tested on-device |
| wl (directory batch) | 🔵 Source confirmed | Not yet tested on-device |