What EDL mode actually is
Emergency Download mode is a Qualcomm service interface implemented in the chipset's primary boot loader. It exists so the manufacturer can recover a device whose firmware is corrupt — it runs before Android, before the bootloader menu, and before any user-level security.
Because it sits below the OS, an FRP lock is irrelevant to reaching it. FRP is an Android-userland policy; EDL is silicon. That is the whole reason this route survives on a locked, un-bootable handset.
You usually do not need a test point
A test point means opening the phone and shorting two pads to force the chipset into EDL. It is a technique for devices whose key combination has been disabled or whose bootloader is unresponsive.
On most retail Snapdragon handsets the key combination alone reaches 9008. Try that first. Only consider opening the device if the handset genuinely refuses to enumerate — and understand that disassembly risks the water-resistance seal and can void any remaining warranty.
Confirming you are actually in EDL
The definitive signal is the Windows device tree. Qualcomm EDL enumerates as vendor 05C6 with product 9008, and FRPB reports exactly that. If you see a different vendor or product ID, you are in some other mode.
The screen being black is necessary but not sufficient — plenty of failure modes also produce a black screen. Always confirm from the detected USB IDs, not from the display.
What gets written, and the risks
FRPB performs a Sahara/Firehose exchange — the documented Qualcomm programmer handshake — then issues the partition-level operation that clears the account lock. It does not invent a payload: without the correct Firehose programmer for your exact chipset, no tool can talk to EDL meaningfully.
The real risk with EDL is using a programmer for the wrong SoC. If FRPB reports a chipset you do not recognise for the device in hand, stop. Proceeding with a mismatched programmer can leave the device in a state that needs a full firmware flash to recover.
If the device will not enter EDL
Work through the basics first: a charge-only cable, a USB hub, or an already-powered device will all prevent entry. Use a known-good data cable directly into a rear port, and make sure the phone is genuinely powered off.
Some carrier and enterprise variants disable the volume-key entry path in firmware. Those units need a test point or an authorised service centre — FRPB will report that it cannot see a 9008 endpoint rather than pretending an operation succeeded.
Step-by-step procedure
Follow the sequence below in order. Each step is also published as structured HowTo data, so search results can surface it as a step-by-step list.
- 1Power the Snapdragon device off completely.
- 2Hold Volume Up + Volume Down simultaneously.
- 3Connect the USB cable while holding both buttons.
- 4Keep holding until the screen stays black — the device is now in EDL 9008.
- 5Confirm FRPB reports the 05C6:9008 transport.
- 6Click FRP Bypass and accept the authorised-owner disclaimer.
- 7Let the EDL handshake and partition operation complete, then allow the reboot.
Safety, legality and when to stop
FRPB is intended strictly for authorised device owners and licensed repair professionals. You must own the device or hold explicit written permission from its owner. Using an FRP bypass tool on hardware you do not own may defeat an anti-theft control and can be illegal in your jurisdiction.
Stop and reassess if the device reports a bootloader state you did not expect, if the model or chipset FRPB detects does not match the handset in front of you, or if the operation halts mid-way. A mismatched firmware package is the single most common cause of a hard brick — abandoning an operation is always cheaper than recovering from one.