Some little technical blog

How to revive your bricked Sierra Wireless EM7345

BrickedWhen playing with some EM7345 AT commands I was able to permanently bring the device down. Yes, THERE IS at least one AT command that can brick your EM7345 beyond repair! But not anymore, I found a way to revive a bricked EM7345 back to normal.

I’m going to publish some interesting information about that AT command in one of my following posts, as it’s really worth it, since it’s related to the infamous Carrier IQ scandal. Hey Intel, are you spying on us too?

But first things first, now I’m going to explain how to get your bricked EM7345 back to normal.

WARNING: The method described in this post is only applicable to EM7345 devices installed in Lenovo laptops! Lenovo tablets have another hardware subtype of EM7345 and the firmwares for laptop and tablet are not mutually compatible! Don’t ever try to crossflash!

This method is only applicable for the symptoms described below. If your circumstances are different, don’t try this method!

Sometimes your EM7345 can die with the following symptoms:

  • The device “Sierra Wireless EM7345 4G LTE” is not shown in Device Manager
  • AT COM ports and GNSS sensor device are not shown in Device Manager
  • Instead, a new USB device, named “Intel(R) USB Flash Loader Utility” is shown in Device Manager Intel Flash Loader
  • The above device is constantly disappearing and reappearing again, and Device Manager is “refreshing” on its own every 2-3 seconds
  • Intel Firmware Updater doesn’t recognize the device at all and you can’t flash it
  • Rebooting, detaching the battery, removing the EM7345 from the laptop, enabling or disabling that Intel USB device in Device Manager doesn’t help. The device is not recognized by Windows, you cannot use it anymore

Bricked for good, you’d say. But, there’s a way now.

Download and unzip the following file: FlashTool

Go to the unzipped folder and run “FlashTool_E2.exe”.

Infineon Flash ToolPress “Add” button and find a correct firmware file for your EM7345. On the picture above, I’m using 1415.07 firmware, you can also use 1415.09 or any other firmware. The firmware must be in FLS format! You can find EM7345 FLS firmwares in the folder “c:\ProgramData\Intel\MBIM Toolkit\FirmwareDatabase\PreInstalled” if you have Lenovo drivers installed.

Set everything as shown on the picture. All ticks, baud rate, channels, communication driver, especially erase settings!

Then notice the VID and PID of that Intel USB device in Device Manager.

Flash Loader ID

The VID is 8087 and PID is 0716 here.

Open Flash Tool E2 File-> USB Map Wizard:

Flash Tool USB Map Wizard

Make sure USB Detection String has the same numerical IDs as your Intel Flash Loader USB device in Device Manager! Correct it if necessary, and press Next button. The next time Device Manager “refreshes” itself, the device will be shown in the list as Detected. Press Done button.

Flash Tool Detected

Now, you’re ready. Double check all the settings in the Flash Tool and press Next button. It will show the following window:

Flash Tool Ready1

All you have to do now is just press “Start USB1” button. In a few seconds your Em7345 will be recognized, erased and then reflashed. After it’s done you should see a message that all went well and completed 100% without errors. Then you can check again in Device Manager and make sure that Intel USB Flash Loader Utility is shown steadily and is not disappearing like before. Device Manager should not also constantly “refresh” itself. If it’s so, just turn off your Lenovo laptop now and disconnect the power cord. The idea here is to power off EM7345 completely.

Next, power on the laptop again and your EM7345 should be back up and running as before. It will be shown in Device Manager, AT ports will be back, so will be the GNSS sensor.

Congrats, you just revived your bricked EM7345!

And sometimes, it’s necessary to reflash your newly restored EM7345 again, using Intel Firmware Updater this time. This is needed when you get odd connection errors or AT+XLOG showing lots of errors. Intel Firmware Updater accepts only FLZ files, not FLS, so make sure you do it accordingly. Refer to this post for instructions. After I reflashed my EM7345 the second time, I saw no more errors added to AT+XLOG error log.

22 Responses to How to revive your bricked Sierra Wireless EM7345

  • Thanks, zukota

    It seems my link to the Infineon flash tool has been turned out to be helpful.
    Did you investigate the purpose of the IFX_DL.exe tool in that package?

    • Hi Serge,
      IFX_DL.exe is the command-line version of the Infineon flasher. I have never used it, always using the GUI version. Moreover, both of those programs are just the user interface for IFWD_DownloadDll.dll, which is carrying on actual flashing. Flash tools create a log file during flashing, which can be read and analyzed using TraceViewer.exe. Also I’ve found a source code that is using Infineon flashing protocol: https://github.com/astarasikov/samsung-xmm6260-fw-loader/blob/master/fwloader_i9250.c. Also I’ve made attempts to “unpack” FLS files but didn’t find much information on this format. RevSkills can unpack FLS files, but cannot pack it back. That’s all I know so far 🙂

  • how to use mbim tool for imei change (deviceID)

  • You’re probably already aware, but there’s a newer firmware recently released for Win7. Mine auto-updated and is now on version: FIH7160_V1.2_WW_01.1426.16_TS

    Nothing major seems to have changed and the supporting Sierra software is the same. Not much in Lenovo’s changelog either beyond minor improvements.

  • Need some help guys, my Sierra EM7345 was working great until recently when windows 10 updated to the newest build, then i started having problems. After trying to reinstall the driver a few times, ultimately it no longer shows up in device manager at all. I have stepped back to a clean windows 7 install and it’s still not showing. I don’t have “USB flash loader utility” either. Any ideas ?

    • Is the device visible on the USB bus? Have some check using a diagnostic software like AIDA 64 to scan your USB bus. Maybe the device has some other VID/PID now. Try to fully unpower your laptop and reconnect your EM7345 from the laptop.

      • Thanks, I opened the laptop back up, disconnected then reconnected the chip and its working good again. Not sure what went wrong but I guess I’ll avoid windows 10 for a while.

  • I am facing an issue with several X240 and X250 laptops (win 7 64) using the Vodafone Ultracards (multiple SIM cards sharing one number and contract) where the Sierra EM7345 blocks all incoming phone calls on the iPhone. The solution is apparently to disable the voice channel on the EM7345 via command but I have no idea how to perform that step on a Win 7 machine.

  • First of all – thanks for the guide, totally saved my day!

    BUT, I had a little different experience and had to improvise a bit.

    * The in Device Manager “Intel(R) USB Flash Loader Utility” was only briefly visible after boot, it did not appear certain interval. So I had to act quick to open the “Properties” to get VID/PID.
    * In the Flash Tool E2 “USB Port Mapping Calibration” the USB port would not be detected. So I shut down the machine, removed the WWAN module. Booted the machine and while in the Flash Tool E2 “USB Port Mapping Calibration” I plugged the WWAN module back in and then it appeared.
    * Once done, I had to act quick and press “Next” and then “Start USB1”. If I slept a bit, I would get “USB boot timeout” error.

    Initial firmware: FIH7160_XMM7160_V1.1_MBIM_GNSS_NAND_REV_4.5
    Upgraded to: FIH7160_V1.2_WW_01.1528.04 (generic)
    Device: Lenovo T440p
    OS: Windows 10

    BTW: I was not able to update the firmware by Zukota’s any other firmware update guides. I had trouble with “firmware is not for the model” and “USB boot timeout” after a bit improvisation.

  • Hi, could you tell where to get fih7160_v1.2_WW_01.1415.07_NAND_production_signed.fls

    lenovo package installs only this set:

    FIH7160_V1.1_WW_01.1531.00_AT.fls
    FIH7160_V1.2_WW_01.1442.11_Orange.fls
    FIH7160_V1.2_WW_01.1522.02_NMU.fls
    FIH7160_V1.2_WW_01.1528.04_Generic.fls
    FIH7160_V1.2_WW_01.1529.05_VZ.fls
    FIH7160_V1.2_WW_01.1529.06_TS.fls

    i think “production_signed” is very important words because FlashTool_E2 fails on one of firmware blocks with message:

    12,640: CB, ProcessOutlineUpdated: channel: 1, status: “Target error[0]: ‘Security failure.’ Line: 1203 File: security_app.c”
    12,640: CB, ProcessOutlineUpdated: channel: 1, status: “Target error[1]: ‘Handling package type: ReqSecStart failed.’ Line: 660 File: flashlogic_app.c”

    Thanks!

    • You usually see this error when trying to flash a firmware signed with other manufacturer. I tried once to flash Telit firmware into EM7345 and it was failing with the same message. Telit firmwares name have _production_signed suffix. Those can be found in Dell driver packages available for download at the Dell website. They cannot be flashed into EM7345.

      • i tried to flash firmware(s) from Lenovo package 🙁 not sure what to do now, how do you thinks is it possible to find who is real manufacturer ? bought sierra wireless em7345 from one of aliexpress sellers

      • Model: G12Z024.05
        FCC ID: N7NEM7345
        Lenovo PN: SW10A11510
        FRU: 0X6014

        so, seems it is real lenovo module but why it stuck in flashing mode…

        i tried add available fls files i did manage to download 🙂

  • While playing around with AT commands, I seem to have hosed the USB profile on my device. I no longer see any devices at all, just the flashloader very briefly as the card is powered on.

    The flash loader device is available briefly at boot and after a resume from suspend. I’m able to set FlashTool E2 to auto, suspend the laptop, and then successfully flash an FLS to the modem when the laptop wakes (or hotplug the modem as another poster did), and the flash loader device persists upon completion of the flash, but the card never presents an mbim or acm device.

    Any thoughts on how I can switch this USB profile back? I fear I may have bricked the thing.

  • Hi,

    I have a EM7345 firmware 1415.07, and I couldn’t get the new firmware 1612.00 to install by Intel flashing tool. So after reading https://zukota.com/sierra-wireless-em7345-whos-spying-on-us/, I thought I could induce (!) it to crash by disabling Carrier IQ. But instead of appearing as Intel Flash Loader Utility, it only shows as 1 CDC. Any suggestion to get this device flashable?

    • Update: To start flashing in the window that the Flash Loader Utility device is present, in FlashTool Menu > Settings > Auto Start, choose “Auto Start (USB only)”, then begin flashing. FlashTool will poll for the device much faster than I ever can.

  • Hi Zukota,

    I’ve follow Your firmware update procedures and finally I’ve start update EM7345 but when it comes to 40% i stopped and failed bricking my device.
    I’ve tried Your tips but Intel USB Flash driver didnt appear in my Device Manager.
    I’ve tried to hot plug modem with prepared Flash Tool and it found modem and flash firmware in couple of seconds.
    Thanks o lot for Your great job to revive this devices and flashing firmware’s on it.

    Kind Regards
    Dariusz

    • Hi Dariusz.
      40% is stopped and I’ve tried Your tips but Intel USB Flash driver didnt appear in my Device Manager.
      Can you give me the name “frimware. Tools” in the same situation?

  • Hi Zukota,

    I find the following getting dumped on the Trace port again & again.. can even hear a gong sound on putty in between.(may be it is dumping the ASCII bell character)
    Does that mean that EM7345 is bricked ?
    Querying on AT ports works though… though not all the command that you had listed works.
    OS is Windows 10.

    I am only interested in GPS functionality..(but I have not been successful yet..Is there some dumb requirement to have a sim inserted for that?..hopefully not)

    Àì¯Ç~ C²Ú(_
    FIH7160_XMM7160_V1.2_MBIM_GNSS_NAND_REV_4.5 2014-Jun-5 11:54:58
    / CustVer:FIH7160_V1.2_WW_01.1415.07
    À¯”Tp~ D±½S_
    Chip:Intel X-GOLD716
    Àh-g€~~~~~ E°hËf ìÿ 2ÀtÀ³t~ F¯n¹Ëf ìÿ 2Ô” ÀaÛ­”~ G®ç¹Ëf n $ºËf Ô”À{µ~ H­’ºËf
    # SPath=fih7160_v1.2/FIH7160_XMM7160_V1.2_MBIM_GNSS_NAND_REV_4.5__FIH7160_V1.2_WW_01.1415.07

    sttdecoder-2g_i_dsp-xmm7160-1306.00,94795b0478751cb2540974f09a8b0eef

    sttdecoder-2g_o_dsp-xmm7160-1306.00,cb3f83a24f99dd303436285621a48547

    sttdecoder-3gfw-xg636-202.420.181,503da67dfc7af5974e11bd7830e7e29f
    sttdecoder-aud_f_dsp-xmm7160-1306.00,bee49a02548b6d83e2a8e095e1c7fe
    fa
    sttdecoder-aud_s_dsp-xmm7160-1306.00,c7bb53875dcc9024ef798e907df5103d

    sttdecoder-bb_sw-cdd-1.0.0.9,797af7082465767a1bcf96c8d5f79a23

    sttdecoder-bb_sw-egdci-fih7160_v1.2-2014.06.05_01.1415.07,4ff3323123845280ab8408cf75df6753

    sttdecoder-bb_sw-expro-1,dffef3ec4e960049078bcb9e7cb77fed

    sttdecoder-bb_sw-fascii-2,2d3454d60d5411ef9de8ccb42fbc9a1a

    sttdecoder-bb_sw-llt-fih7160_v1.2-2014.06.05_01.1415.07,f1e18e6ab3eff17af1f4ffef89892ff0

    sttdecoder-bb_sw-lms,a40f60fb456ed67a6f158cd240c4d799

    sttdecoder-bb_sw-lte_stk-fih7160_v1.2-2014.06.05_01.1415.07,8f8c5e26bcb5f3cb6ba04993dd86f7c6

    sttdecoder-bb_sw-mon-fih7160_v1.2-2014.06.05_01.1415.07,90f3965998e051df0e35ca472db89f51

    sttdecoder-bb_sw-nvm-fih7160_v1.2-2014.06.05_01.1415.07,27ba77e926642ac68207d9e778091f24

    sttdecoder-bb_sw-rtc-13.38.0000,e8185ca58b84ae58a72ff80bc908891d

    sttdecoder-bb_sw-sdl-fih7160_v1.2-2014.06.05_01.1415.07,d714e5b7effbd215cf17053208df0979

    sttdecoder-bb_sw-trap-1.0.0.8,d0e3a3f13b06f58ed91b0927a15e13cf

    sttdecoder-bb_sw-uascii-3,7d9137993ddb2721e5f05938c3881c96

    sttdecoder-bb_sw-ugdci-fih7160_v1.2-2014.06.05_01.1415.07,c151942dc3b16ceaa491f50460ecff5f

    sttdecoder-bb_sw-ver-13.38.0000,873d526dd4edef1fc428a99de29c1d61

    sttdecoder-bb_sw-xllt-fih7160_v1.2-2014.06.05_01.1415.07,5676e6ab9b8dd1d61b638c1f325d2991

    sttdecoder-digrf-S4GV2_BL_INITCFG_3.310.0.0.30810.0.0,b429e31aea9ea9ff0c4bc1b1df0135cd

    sttdecoder-ltel1-d3_f7160.S3.561.05.3.421.00.0017,f57968afdda0d2905ea0f93a037dd10d

    sttdecoder-macphy-21,dee91222daec2d48ff562087c1ac75da

    sttdecoder-stb_gps-nmea0183-12.46.0002,19cfa6e2d071f584ed3dc327089ecc5a

    sttdecoder-stmon-1,e054707b1a4a9ec9e936bdf26c34a6d6

    Àbm&i~~~ I¬N‹n ìÿ 2ÀPŒÜß~ J«Ö^‹n ìÿ 2Ô’ ÀXŸ§L~ KªA_‹n ö/ u_‹n Ô’Àæ26~ L©Ù_‹n

    • You don’t need to use the Trace port. It’s used only for debug purposes, there’s a trace tool included in the EM7345 drivers from Lenovo. The tool connects to that trace port in order to gather some debug logs so the developers could fix bugs in the EM7345 firmware.

Leave a Reply

Your email address will not be published. Required fields are marked *