OMG!
Exactly one of them (sdm660/3006000000010000_7e425bcb25364725_fhprg_peek.bin) worked!
Code:
<log value="Calling usb_al_bulk_set_zlp_mode(TRUE) since ZlpAwareHost='1'"/>
<response value="ACK" MinVersionSupported="1" MemoryName="UFS" MaxPayloadSizeFromTargetInBytes="4096" MaxPayloadSizeToTargetInBytes="65536" MaxPayloadSizeToTargetInBytesSupported="65536" MaxXMLSizeInBytes="4096" Version="1" TargetName="MSM8996" DateTime="Dec 8 2017 - 13:33:11" />
Ok
Requesting info on LUN 0...
<log value="INFO: Device Total Logical Blocks: 0xd7d800"/>
<log value="INFO: Device Block Size in Bytes: 0x1000"/>
<log value="INFO: Device Total Physical Partitions: 0x0"/>
<log value="INFO: Device Manufacturer ID: 0x1ce"/>
<log value="INFO: Device Serial Number: 0x4d53554e"/>
<log value="INFO: {"storage_info": {"total_blocks":14145536, "block_size":4096, "page_size":4096, "num_physical":6, "manufacturer_id":462, "serial_num":1297306958, "fw_version":"400","mem_type":"UFS","prod_name":"KM5H7001DM-B424"}}"/>
<log value="UFS fInitialized: 0x1"/>
<log value="UFS Current LUN Number: = 0xd0"/>
<log value="UFS Total Active LU: 0x6"/>
<log value="UFS wManufacturerID: 0x1ce"/>
<log value="UFS Boot Partition Enabled: 0x1"/>
<log value="UFS Raw Device Capacity: = 0x7734000"/>
<log value="UFS Min Block Size: 0x8"/>
<log value="UFS Erase Block Size: 0x2000"/>
<log value="UFS Allocation Unit Size: 0x1"/>
<log value="UFS RPMB ReadWrite Size: = 0x40"/>
<log value="UFS Number of Allocation Uint for This LU: 0x0"/>
<log value="UFS Logical Block Size: 0x0"/>
<log value="UFS Provisioning Type: 0x0"/>
<log value="UFS LU Write Protect: 0x0"/>
<log value="UFS Boot LUN ID: = 0x0"/>
<log value="UFS Memory Type: 0x0"/>
<log value="UFS LU Total Blocks: 0x0"/>
<log value="UFS Supported Memory Types: 0x800f"/>
<log value="UFS dEnhanced1MaxNAllocU: 0x3b9a"/>
<log value="UFS wEnhanced1CapAdjFac: 0x200"/>
<log value="UFS dEnhanced2MaxNAllocU: = 0x0"/>
<log value="UFS wEnhanced2CapAdjFac: 0x0"/>
<log value="UFS dEnhanced3MaxNAllocU: 0x0"/>
<log value="UFS wEnhanced3CapAdjFac: 0x0"/>
<log value="UFS dEnhanced4MaxNAllocU: 0x0"/>
<log value="UFS wEnhanced4CapAdjFac: 0x0"/>
<log value="UFS LUN Enable Bitmask: 0x3f"/>
<log value="UFS Logical Block Count: 0x0"/>
<log value="UFS bConfigDescrLock: 0x0"/>
<log value="UFS iManufacturerName String Index: 0x0"/>
<log value="UFS iProductName String Index: 0x1"/>
<log value="UFS iSerialNumber String Index: 0x2"/>
<log value="UFS iOemID String Index: 0x3"/>
<log value="UFS Inquiry Command Output: SAMSUNG KM5H7001DM-B424 0400 "/>
<response value="ACK" />
Ok
Requesting GPT 0 header...
<response value="ACK" rawmode="true" />
Ok, receiving...
<log value="Finished reading from sector address 1 to 2"/>
<response value="ACK" rawmode="false" />
Ok, requesting entries...
<response value="ACK" rawmode="true" />
Ok, receiving...
<log value="Finished reading from sector address 2 to 3"/>
<response value="ACK" rawmode="false" />
Ok
Requesting GPT 1 header...
<response value="ACK" rawmode="true" />
Ok, receiving...
<log value="Finished reading from sector address 1 to 2"/>
<response value="ACK" rawmode="false" />
Ok, requesting entries...
<response value="ACK" rawmode="true" />
Ok, receiving...
<log value="Finished reading from sector address 2 to 3"/>
<response value="ACK" rawmode="false" />
Ok
Requesting GPT 2 header...
<response value="ACK" rawmode="true" />
Ok, receiving...
<log value="Finished reading from sector address 1 to 2"/>
<response value="ACK" rawmode="false" />
Ok, requesting entries...
<response value="ACK" rawmode="true" />
Ok, receiving...
<log value="Finished reading from sector address 2 to 3"/>
<response value="ACK" rawmode="false" />
Ok
Requesting GPT 3 header...
<response value="ACK" rawmode="true" />
Ok, receiving...
<log value="Finished reading from sector address 1 to 2"/>
<response value="ACK" rawmode="false" />
Ok, requesting entries...
<response value="ACK" rawmode="true" />
Ok, receiving...
<log value="Finished reading from sector address 2 to 3"/>
<response value="ACK" rawmode="false" />
Ok
Requesting GPT 4 header...
<response value="ACK" rawmode="true" />
Ok, receiving...
<log value="Finished reading from sector address 1 to 2"/>
<response value="ACK" rawmode="false" />
Ok, requesting entries...
<response value="ACK" rawmode="true" />
Ok, receiving...
<log value="Finished reading from sector address 2 to 4"/>
<response value="ACK" rawmode="false" />
Ok
Requesting GPT 5 header...
<response value="ACK" rawmode="true" />
Ok, receiving...
<log value="Finished reading from sector address 1 to 2"/>
<response value="ACK" rawmode="false" />
Ok, requesting entries...
<response value="ACK" rawmode="true" />
Ok, receiving...
<log value="Finished reading from sector address 2 to 3"/>
<response value="ACK" rawmode="false" />
Ok
LUN # Name Start Count Type
─── ── ──────────────── ────────── ────────── ────────────────────
0 1 ssd 6 2 Secure SW download
0 2 persist 8 8192 Persist
0 3 misc 8200 256 Misc
0 4 keystore 8456 128 Key store
0 5 frp 8584 128 FRP
0 6 system 8712 786432 System
0 7 cache 795144 65536 Cache
0 8 logdump 860680 16384 Log dump
0 9 onyxconfig 877064 8192 System
0 10 userdata 885256 13260275 User data
1 1 xbl 6 896 Bootloader
1 2 last_parti 902 117 Empty
2 1 xblbak 6 896 Bootloader
2 2 last_parti 902 117 Empty
3 1 cdt 6 1 CDT
3 2 ddr 7 256 DDR
3 3 last_parti 263 32500 Empty
4 1 rpm 6 128 Resource/power mgmt
4 2 tz 134 1024 TrustZone
4 3 hyp 1158 128 Hypervisor
4 4 pmic 1286 128 PMIC
4 5 modem 1414 28160 FAT32
4 6 bluetooth 29574 256 Bluetooth
4 7 dsp 29830 4096 DSP
4 8 abl 33926 256 Android bootloader
4 9 keymaster 34182 256 Key master
4 10 mdtpsecapp 34438 1024 MDTP secure
4 11 mdtp 35462 8192 MDTP
4 12 boot 43654 16384 Boot
4 13 cmnlib 60038 256 Common lib
4 14 cmnlib64 60294 256 Common lib64
4 15 devcfg 60550 256 Device config
4 16 vbmeta 60806 16 VB meta
4 17 vendor 60822 204800 System
4 18 recovery 265622 16384 Recovery
4 19 fsg 282006 512 Modem storage
4 20 sec 282518 4 Sec
4 21 dip 282522 256 DIP
4 22 devinfo 282778 1 Device info
4 23 apdp 282779 64 APDP
4 24 msadp 282843 64 MSADP
4 25 dpo 282907 1 DPO
4 26 splash 282908 8356 Splash
4 27 limits 291264 1 Limits
4 28 toolsfv 291265 256 Tools FV
4 29 logfs 291521 2048 Log FS
4 30 sti 293569 512 STI
4 31 storsec 294081 32 Store secure
4 32 rawdump 294113 32768 RAM dump
4 33 last_parti 326881 721690 Empty
5 1 modemst1 6 512 Modem ST1
5 2 modemst2 518 512 Modem ST2
5 3 fsc 1030 1 FSC
5 4 last_parti 1031 392180 Empty
I double checked and pulled a partition via EDL and double checked its hash against the partition pulled from live system, same values!
Time to party!
Thanks so much!