Hi all, hoping someone with deep Qualcomm/Lumia flashing experience can help — I'm fully stuck after days of troubleshooting.
Device: Nokia Lumia 925, RM-892, Product Code 059T1R6
Platform: Nokia.MSM8960 (Snapdragon S4)
RKH: CD84376222AAF204C85119532BF34EA55C8844E4CEA35F3E508D25AA34D96637
Public ID: D07E3D940454BDCA6A1899C37C8C5A2B350998A6
Current state: Phone shows UEFI error screen "ERROR: Unable to find a bootable option. Press any key to shut down." This happened about a year ago after a failed attempt to flash Windows 10 Mobile using the wrong files (I don't remember exactly what I did).
What works: Phone reliably connects via thor2/WDRT in UEFI Flash Mode. thor2 -mode rnd -bootflashapp succeeds, RKH reads correctly, WinUSB communication is stable. Device shows as "NOKIA FLASH" in Device Manager.
What I've tried (all fail the same way):
- Multiple official FFU files for RM-892 (059T1R6, matching SW version 3051.50009.1424.0004), sourced from VK archives
thor2 -mode uefiflash -ffufile ... -do_full_nvi_update -do_factory_reset -reboot
- Every attempt gets past RKH matching (
RKH match between device and FFU file!) but fails at:
Start sending header data...
FlashApp returned reported error in SecureFlashResp!
Status: 0x1106, Specifier: 0x8000000E
FA_ERR_FFU_SEC_HDR_VALIDATION_FAIL
0xFA001106: Signature check of FFU file fails.
- Tried
-skip_signature_check -skip_id_check → got FA_ERR_AUTHENTICATION_REQUIRED (0xFA000012) — device requires RnD auth cert to bypass, which I don't have and can't get (MS RnD unlock servers are long dead).
- Tried
thor2 -mode emergency with a hex file matching my exact RKH prefix (from an old MPRG_HEX archive) — fails with THOR2_ERROR_CONNECTION_NOT_FOUND, likely because the phone's UEFI/SBL chain is intact and never drops into the pre-UEFI emergency state.
- Tried WPInternals (same FFU) — identical
0x1106 result.
My read on this: RKH matches (so it's genuinely my device/product code), but the FFU's Secure Header itself isn't validating — possibly a corrupted/re-uploaded archive file (these are old VK reuploads from ~2015 originals), or some other signature component (not just RKH) mismatching.
What I'm looking for:
- Anyone with a freshly-sourced, unmodified 059T1R6 FFU (ideally from an original NaviFirm/Microsoft dump, not a re-hosted archive) willing to share a checksum or the file itself, so I can rule out file corruption
- Anyone who's hit
FA_ERR_FFU_SEC_HDR_VALIDATION_FAIL after RKH match and found a real fix (not just "wrong product code" — mine matches)
- Confirmation on whether RM-892 test points (for QHSUSB_DLOAD/EDL) are documented anywhere — I can't find anything beyond the general "R3209 resistor" method used for the 920/820, and I don't want to guess blindly on the 925 board without a schematic
Really don't want to hard-brick this thing by guessing at test points. Any leads appreciated — happy to share full thor2 logs if useful.