Recover a Bricked TBox Ultra With QFIL (EDL, Firehose, UFS)

Is your Ultra really bricked?

A bricked box never finishes booting: the LED lights and stays that way, the head unit never shows the box, and a phone app that lists USB devices does not see it either. Before you reach for QFIL, rule out the three faults that look like a brick but are not.

• Wrong protocol. The button you use for EDL also switches CarPlay and Android Auto when pressed briefly on a running box. Owners who pressed it “to reset” ended up in a protocol their car does not support. Switch back as described in switch the box’s protocol.
• ADB mode left on. After engineering code 142618 the USB port talks to computers, not cars. See “Device not supported” after enabling ADB.
• Black screen on a running box. If the box boots (Wi-Fi and Bluetooth appear) but the screen stays dark, read black screen after boot on TBox Ultra first.

If the box boots far enough for the FOTA app, a normal local firmware update is safer than anything on this page. QFIL is for the case where nothing else can reach the box.

What QFIL and EDL do

Every Ultra uses a Qualcomm SM6350 (QCM6350) chip. Below Android there is a read-only boot ROM with an emergency download mode, called EDL. In EDL the box shows up on a PC as “Qualcomm HS-USB QDLoader 9008”, even when everything above it is broken.

QFIL is Qualcomm’s flashing tool. It first sends a small loader, the firehose programmer, over a protocol called Sahara. The programmer then writes the partition images to the box’s UFS storage, following the XML files in the recovery package: rawprogram files say which image goes where, patch files fix up the partition table.

That is why the package has to match the box exactly. A programmer for another chip fails at the Sahara stage; images for another model can write successfully and still leave a box that does not start.

Get the right recovery package

Carlinkit makes recovery packages per model and chipset. Owners described the Ultra packages as Android 15 UFS image sets; the ones discussed carried the 21 Oct 2025 and 20 Mar 2026 builds, and the date you receive may differ. The Ultra 3 has its own firmware line: one Ultra 3 owner who installed a build made for the Ultra 2 found the box sluggish and the small display on its case showing interference, and other owners advised using only Ultra 3 builds on an Ultra 3 to keep that display working.

Unzip the package to a short path with no spaces or non-Latin characters, for example C:\recovery\ultra. Inside you should find:

• a firehose programmer, a file named like prog_firehose_ddr.elf;
• one or more rawprogram*.xml files and matching patch*.xml files;
• the partition images themselves (.img, .elf, .mbn, .bin);
• often a text or picture note saying which rawprogram file to use.

A normal update.zip for the FOTA app is not a recovery package. QFIL cannot use it.

Steps

Select Build Type : Flat Build
Select Programmer : C:\recovery\ultra\prog_firehose_ddr.elf
Device Type       : ufs
Load XML          : rawprogram0_update_sd.xml  +  patch0.xml

Verify it worked

The box should boot to the stock launcher with a fresh setup. Then check:

1. Settings → About shows a build date close to the package date.
2. The head unit shows the box in your usual protocol. If not, switch protocol before suspecting the flash.
3. Insert the SIM and open a web page with Wi-Fi off. If the SIM is not detected, or About → Status shows no IMEI, the wrong rawprogram file was used; see troubleshooting below.
4. Look at the status bar. One Ultra 4 owner got the network exclamation mark after recovery; the exclamation mark fix covers it.

One owner of another TBox model saw a “Device not activated” QR screen after recovery. Giving the box internet, by SIM or phone hotspot, cleared it; see QR code / device not activated.

Undo / rollback

There is no way back to the exact state before the brick, because a recovery flash wipes everything. Your realistic options afterwards:

• Move to any official build for your model with the FOTA local update; Carlinkit builds for the same model install over each other.
• If you had root or multitouch before, set it up again from root with Magisk or enable multitouch. Both start from a clean, booting box.
• If the box will not come back after two careful attempts with the correct package, it is a support case, not a QFIL case.

Troubleshooting this guide

“Sahara protocol error”, or “Unable to read packet header. Only read 0 bytes”. Check these in order:

1. The box is not in EDL mode. Device Manager must show the 9008 port, not an Android or unknown device.
2. The programmer does not match. The Ultra needs the SM6350 programmer from its own recovery package.
3. The package does not match the chip or memory type. An Ambient owner had Sahara errors until he used the package for his chip in the right UFS or eMMC variant; then it worked.
4. The QFIL build is the problem. Use the QFIL inside QPST, as above.

QFIL freezes or Partition Manager never opens on Windows 11. Use an administrator account with a Latin-only user name and no spaces, and keep the files in a short path.

“Failed to initialize (open whole lun) UFS”. The storage type in FireHose Configuration does not match the box. Every Ultra package owners described was UFS; on older TBox models this error meant eMMC was needed.

The SIM or IMEI is gone after recovery. This happened to an Ambient owner who ticked Erase All Before Download, and the admins warn that the wrong rawprogram variant in the Ultra 1 and 2 packages leaves the SIM unusable too. It wipes the partitions that hold your IMEI and radio calibration, and they are not in the recovery package. Contact Carlinkit support; do not install another box’s modem files.

The box stopped showing any sign of life after flashing single partitions. One Ultra owner wrote partitions one by one, filled the Bluetooth partition with zeros by mistake and lost the LED, ADB and video, although EDL still worked. Flash the whole package through its rawprogram and patch files only.

Download Succeed, but the box still does not boot. Flash again from a fresh EDL session. Then check you used the Ultra 3 package on an Ultra 3 and the Ultra 1/2 package on those models.

The PC never shows a 9008 port. Try a USB 2.0 port and another data cable, reinstall the Qualcomm driver, and hold the button before plugging in.

Other TBox models. The tool and steps are the same, but the programmer, memory type and XML order differ. Some older TBox Plus EM 668 units needed six separate passes, rawprogram0 with patch0 up to rawprogram5 with patch5, re-entering EDL between each. Follow the instructions inside your model’s package, and use which TBox do I have to be sure of the model first.