qualcomm edl firehose programmers

Above both of the method (method 1 & method 2) are not working for Redmi 7a, Can you please confirm if i have to use Method 3: By Shorting Hardware Test Points to enter into EDL mode? Digging into the programmers code (Xiaomi Note 5A ugglite aarch32 programmer in this case) shows that its actually an extended SBL of some sort. In Part 2, we discuss storage-based attacks exploiting a functionality of EDL programmers we will see a few concrete examples such as unlocking the Xiaomi Note 5A (codename ugglite) bootloader in order to install and load a malicious boot image thus breaking the chain-of-trust. Thread starter sloshnmosh; Start date Jun 12, 2018; Forums. Analyzing several programmers' binaries quickly reveals that commands are passed through XMLs (over USB). therefore we can simply load arbitrary code in such pages, and force the execution towards that code for Nokia 6, ROP was not needed after all! This is done inside some_sahara_stuff which gets called if either pbl->bootmode is edl, or the flash initialization has failed: Later, when the PBL actually tries to load the SBL from the flash drive, it will consider the pbl->flash->initialized field and use the Sahara protocol instead: The PBL later jumps to the SBL entry point, with the aforementioned pbl2sbl_data: As mentioned above, modern EDL programmers implement the Qualcomm Firehose protocol. Finding the vector base address is a trivial task, as it can be done either statically, by reverse-engineering the programmers code, or even better - in runtime. A working 8110 4G firehose found, should be compatible with any version. If the author of the solution wants to disclose any information, we can do this as well and give him credits, but for now the origins remain a secret (to protect both us and him). At the beginning we naively implemented breakpoints for 2-byte Thumb instructions with 16-bit long invalid instructions (0xFFFF), however we soon realized it was problematic as they might actually result in valid 32-bit instructions, depending on the adjacent word. Research & Exploitation framework for Qualcomm EDL Firehose programmers, By Roee Hay (@roeehay) & Noam Hadad, Aleph Reseserch, HCL Technologies. The following example shows the UART output of our debugger running in the context of the OnePlus 5 programmer: On Xiaomi 5As aarch32 programmer the debugger prints the following: A significant feature of our debugger is that it is fully relocatable, and its memory layout is configurable depending on the target. For example, here are the Test Points on our Xiaomi Note 5A board: In addition, if the PBL fails to verify the SBL, or fails to initialize the flash, it will fall-back into EDL, and again, by using our research tool we found the relevant code part in the PBL that implements this. My proposed format is the following: - exact model name. We achieve code execution in the PBL (or more accurately, in a PBL clone), allowing us to defeat the chain of trust, gaining code execution in every part of the bootloader chain, including TrustZone, and the High Level OS (Android) itself. HWID: 0x000940e100420050 (MSM_ID:0x000940e1,OEM_ID:0x0042,MODEL_ID:0x0050). As one can see, the relevant tag that instructs the programmer to flash a new image is program. The SBL initializes the DDR and loads digitally-signed images such as ABOOT (which implements the fastboot interface) & TrustZone, and again verifies their authenticity. So if anyone has any tips on how to find a loader for it (or for other Android flip phones, for that matter), I would be interested. to get back the 0x9008 mode : Use a edl cable (Short D+ with GND) and force reboot the phone (either vol up + power pressing for more than 20 seconds or disconnect battery), works with emmc + ufs flash (this will only work if XBL/SBL isn't broken). I'm not sure if I'm using the right file, but I can see quite a bit of raw data being exchanged by using the client's --debug option. In the previous chapters we presented Qualcomm Sahara, EDL and the problem of the leaked Firehose programmers. Read our comment policy fully before posting a comment. Research & Exploitation framework for, A couple of years ago, it is easy to unbrick a Xiaomi device through Emergency Download Mode (, Programming & Flashing. Some devices have an XBL (eXtensible Bootloader) instead of an SBL. Seems like CAT is using generic HWID for 8909 devices We got very lucky with this. The signed certificates have a root certificate anchored in hardware. He loves to publish tutorials on Android IOS Fixing. Which, in our case, is the set of Qualcomm EDL programmer/loader binaries of Firehose standard. So, I know the only file from this archive for sure: Filename: prog_emmc_firehose_8909_alcF.mbn. This isn't strictly speaking a Bananahackers question (because it's about Android phones), but this is where I learned about EDL mode. Tested on our Nexus 6P, trying to read from its PBL physical address (0xFC010000), instantly resulted in a system reboot. You will need to open the ufs die and short the clk line on boot, some boards have special test points for that. HWID: 0x009600e100000000 (MSM_ID:0x009600e1,OEM_ID:0x0000,MODEL_ID:0x0000), PK_HASH: 0xcc3153a80293939b90d02d3bf8b23e0292e452fef662c74998421adad42a380f. To do so, we devised a ROP-based exploit, in order to leak the TTBR0 register, which holds the base address of the page table. Research & Exploitation framework for Qualcomm EDL Firehose programmers. the last gadget will return to the original caller, and the device will keep processing Firehose commands. However, thats not the case always. Without which, booting into modes like Fastboot or Download modes wouldnt be possible. emmc Programs File. Research & Exploitation of Qualcomm EDL Firehose Programmers: From PBL (Boot ROM) Extraction, Research & Analysis to Secure Boot Bypass in Nokia 6. . Connect the phone to your PC while its in Fastboot mode. One significant problem we encountered during the development of the debugger is that upload rate over poke is extremely slow. Other devices, such as the OnePlus family, test a hardware key combination upon boot to achieve a similar behavior. Some devices have boot config resistors, if you find the right ones you may enforce booting to sdcard instead of flash. Analyzing their handlers reveals the peek and poke tags expect the following format: Adding this to our research tool, allowed us to easily explore susceptible devices. (Using our research framework we managed to pinpoint the exact location in the PBL that is in charge of evaluating these test points, but more on this next.). Apr 1, 2019 350 106 Innernetz www.noidodroid.com . Deeper down the rabbit hole, analyzing firehose_main and its descendants sheds light on all of the Firehose-accepted XML tags. P.S. Yes, your device needs to be sufficiently charged to enter EDL mode. Check below on the provided lists, If you cannot find your Device Model name, Just comment me below on this Post and be patient while I check & look for a suitable emmc file for your devices. To have a better understanding, please take a look at the figures below. By Roee Hay & Noam Hadad, Aleph Reseserch, HCL TechnologiesResearch & Exploitation framework for, spring boot crud example with mysql database javatpoint, giant ridecontrol dash 2 in 1 bedienungsanleitung, good and beautiful language arts level 3 answer key, 70048773907 navy removal scout 800 pink pill assasin expo van travel bothell punishment shred norelco district ditch required anyhow - Read online for free.. "/>. In order to achieve a fast upload nevertheless, we used the following technique: for each poke we add another XML attribute, which encapsulates our data. In the case of Qualcomm , these programmers are referred to as " firehose >" binaries. Some times, flashing the wrong file can also potentially corrupt the Android bootloader itself. The said protocol(s) can then accept commands from a PC over USB to flash the firmware on a device using tools like QPST, QFIL, MSMDownload, etc. chargers). I must to tell you, I never, ever slow enough to comment on any site .but I was compelled to stop and say THANK YOU THANK YOU THANK . Qualcomm Programmer eMMC UFS Firehose Download folder ArykTECH 349 subscribers Subscribe 40 Share 32K views 5 years ago In this video you will find complete list of available Qualcomm Programmer. For example, here is the UART TX point for OnePlus 5: On some devices UART is not initialized by the programmers. As for the other devices we posses, that have aarch64 programmers, ROP-based exploitation was indeed needed, as no writable/executable pages were found, due to probably the employment of SCTLR.WXN, that disables execution on any writable page, regardless of its NX bit. Improved streaming stuff, Qualcomm Sahara / Firehose Attack Client / Diag Tools. Luckily for us, it turns out that most Android devices expose a UART point, that can be fed into a standard FTDI232. EDL, is implemented by the Primary Bootloader (PBL), allows to escape from the unfortunate situation where the second stage bootloader (stored in flash) is damaged. Many devices expose on their board whats known as Test Points, that if shortened during boot, cause the PBL to divert its execution towards EDL mode. Finding the address of the execution stack. In that case, youre left with only one option, which is to short the test points on your devices mainboard. This could either be done via ADB, fastboot or by shorting the hardware test points if the former two dont work. You can Download and Use this file to remove Screen lock on Qualcomm Supports Devices, and Bypass FRP Google account on all Qualcomm Devices, Qualcomm Prog eMMC Firehose Programmer file Download, Lava V62 Benco FRP File Download (Bypass Google) by SPD Research Tool Latest Free, DarkRa1n iCloud Bypass Tool iOS 16 iOS 15 Download Free Latest, VNROM FILE Ramdisk Tool Download Windows Latest Version Free, Mina Ramdisk Bypass Tool V1.3 Download Latest Version for MAC Free, GSM Gaster Tool V4.0 Download Latest Passcode, Hello Screen Disable Device, OMH Mi Blu Relock Fixer Tool V1 Download Latest Version Free, iOS Factory Reset Tool V1 Download latest version Free, CICADA iTools V4.1 Download Latest Version Setup Free, Oppo A11s No Auth Loader Firehose File Download Free, Motorola G Stylus 5G EDL Firehose Programmer File Download Free. Further updates on this thread will also be reflected at the special. Please take a look at the image posted on this website, it illustrates the correct EDL test points for the Oppo A7. Our next goal was to be able to use these primitives in order to execute code within the programmer itself. 5 The programmer implements the Firehose protocol which allows the host PC to send commands to write into the onboard storage (eMMC, UFS). It seems like EDL mode is only available for a split second and then turn off. Alcatel Onetouch Idol 3. Our XML Hunter searches the relevant memory for such pokes, and decodes the data, contained in the supplied attribute. Debuggers that choose this approach (and not for example, emulate the original instruction while leaving the breakpoint intact), must conduct a single-step in order to place the breakpoint once again. Specifically, the host uploads the following data structure, to FIREHORSE_BASE + ADDR_SCRATCH_OFFSET: The inner structures are described here (32 bit) and here (64 bit). Could anyone please test the attached firehose on 8110 4G (TA-1059 or TA-1048) or 2720 Flip? Before that, we did some preliminary analysis of the MSM8937/MSM8917 PBL, in order to understand its layout in a high-level perspective. For example, if the folder in the Documents directory, the command should be: Now, enable USB debugging on your Android device using the instructions. Thats it! please tell me the solution. You must log in or register to reply here. Nokia 800 Tough seems to have the same HWID. Concretely, in the next chapters we will use and continue the research presented here, to develop: 73C51DE96B5F6F0EE44E40EEBC671322071BC00D705EEBDD7C60705A1AD11248, 74F3DE78AB5CD12EC2E77E35B8D96BD8597D6B00C2BA519C68BE72EA40E0EB79, D18EF172D0D45AACC294212A45FBA91D8A8431CC686B164C6F0E522D476735E9, 9B3184613D694EA24D3BEEBA6944FDB64196FEA7056C833D38D2EF683FD96E9B, 30758B3E0D2E47B19EBCAC1F0A66B545960784AD6D428A2FE3C70E3934C29C7A, 8D417EF2B7F102A17C2715710ABD76B16CBCE8A8FCEB9E9803733E731030176B, 02FFDAA49CF25F7FF287CAB82DA0E4F943CABF6E6A4BFE31C3198D1C2CFA1185, EEF93D29E4EDDA26CCE493B859E22161853439DE7B2151A47DAFE3068EE43ABE, A1B7EB81C61525D6819916847E02E9AE5031BF163D246895780BD0E3F786C7EE, 97EFF4D4111DD90523F6182E05650298B7AE803F0EC36F69A643C031399D8D13, C34EC1FDDFAC05D8F63EED3EE90C8E6983FE2B0E4B2837B30D8619A29633649C, 63A47E46A664CCD1244A36535D10CA0B97B50B510BD481252F786177197C3C44, 964B5C486B200AA6462733A682F9CEAD3EBFAD555CE2FF3622FEA8B279B006EE, 71C4F97535893BA7A3177320143AC94DB4C6584544C01B61860ACA80A477D4C9, CB06DECBE7B1C47D10C97AE815D4FB2A06D62983738D383ED69B25630C394DED, A27232BF1383BB765937AEA1EBDEE8079B8A453F3982B46F5E7096C373D18BB3, 3FDAF99FC506A42FCBC649B7B46D9BB8DD32AEABA4B56C920B45E93A4A7080EA, 48741756201674EB88C580DF1FDB06C7B823DC95B3FC89588A84A495E815FBD4, 8483423802d7f01bf1043365c855885b0eea193bf32ed25041a347bc80c32d6b, 5F1C47435A031331B7F6EC33E8F406EF42BAEF9A4E3C6D2F438A8B827DD00075, 5D45ECF8864DBBC741FB7874F878126E8F23EE9448A3EA1EDE8E16FE02F782C0, 1D4A7043A8A55A19F7E1C294D42872CD57A71B8F370E3D9551A796415E61B434, BF4E25AE6108D6F6C8D9218383BD85273993262EC0EBA088F6C58A04FC02903B, 3DB3B7FD2664D98FD16F432E8D8AD821A85B85BD37701422F563079CB64D084C, ADEB0034FC38C99C8401DCDBA9008EE5A8525BB66F1FC031EE8F4EFC22C5A1DF, 67A7EA77C23FDD1046ECCE7628BFD5975E9949F66ADDD55BB3572CAF9FE97AEA, 2DDE12F09B1217DBBD53860DD9145326A394BF6942131E440C161D9A13DC43DD, 69A6E465C2F1E2CAABB370D398026441B29B45C975778E4682FC5E89283771BD, 61135CB65671284290A99BD9EDF5C075672E7FEBA2A4A79BA9CFACD70CD2EA50, C215AC92B799D755AF0466E14C7F4E4DC53B590F5FBC0D4633AFAFE5CECC41C3, A38C6F01272814E0A47E556B4AD17F999769A0FEE6D3C98343B7DE6DE741E79C, BB5E36491053118486EBCCD5817C5519A53EAE5EDA9730F1127C22DD6C1B5C2B, 5C9CCCF88B6AB026D8165378D6ADA00275A606B8C4AD724FBCA33E8224695207, 67D32C753DDB67982E9AEF0C13D49B33DF1B95CC7997A548D23A49C1DD030194, 7F6CE28D52815A4FAC276F62B99B5ABEB3F73C495F9474EB55204B3B4E6FCE6D. In addition, rebooting into EDL by software is done by asserting the LSB of the 0x193D100 register (also known as tcsr-boot-misc-detect) I have made a working package for Nokia 8110 for flashing with cm2qlm module. Sorry for the false alarm. I have the firehose/programmer for the LG V60 ThinQ. Download the latest Android SDK tools package from. Programmers are pieces of low-level software containing raw flash/read-write functionality that allows for reflashing, similar to Samsung's Odin mode or LG's flash. Catching breakpoints is only one side of the coin, the other recovery and execution of the original instruction. Later, the PBL will actually skip the SBL image loading, and go into EDL mode. Looking to work with some programmers on getting some development going on this. After that click on the select programmers path to browse and select the file. This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository. Use LiveDVD (everything ready to go, based on Ubuntu): Convert own EDL loaders for automatic usage, Because we'd like to flexible dump smartphones, Because memory dumping helps to find issues :). In order to tackle that, we abused the Firehose protocol in the following ways: Egg Hunting. please provide me with the package including the procedure please I need to unbrick my Nokia 8110-4g. We're now entering a phase where fundamental things have to be understood. As soon as the command is entered, your phone will enter Emergency Download Mode. All of our extracted PBLs were 32-bit (run in aarch32), where the SBLs were either aarch32 or aarch64, in which the PBL is in charge of the transition. I dont think the mother board is receiving power as the battery is dead. As we witnessed in Part 1, oddly enough Firehose programmers implement the peek and poke XML tags, which according to our correspondence with Qualcomm, are customizations set by OEMs QPSIIR-909. To do this: On Windows: Open the platform-tools folder. Before we start, we need to configure some stuff, edit the constants.py file in the host directory: This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. We also read the SCR.NS register (if possible) in order to find if we ran in Secure state. If your device is semi bricked and entered the usb pid 0x900E, there are several options ( if possible ) in order to understand its layout in a system.... Oneplus family, test a hardware key combination upon boot to achieve a similar behavior,... Is extremely slow, test a hardware key combination upon boot to achieve a similar behavior debugger is upload! A phase where fundamental things have to be sufficiently charged to enter EDL mode is available. Supplied attribute second and then turn off USB ) EDL Firehose programmers SCR.NS register ( if possible ) order! Hardware key combination upon boot to achieve a similar behavior: 0x009600e100000000 ( MSM_ID:0x009600e1,,! Searches the relevant tag that instructs the programmer to flash a new image is program, resulted! Oneplus family, test a hardware key combination upon boot to achieve a similar behavior for a split and. Branch names, so creating this branch may cause unexpected behavior stuff, Qualcomm Sahara, and! Log in or register to reply here such pokes, and decodes the data, contained the. That upload rate over poke is extremely slow # x27 ; binaries quickly reveals that are. Die and short the test points for that going on this thread will also reflected... A fork outside of the repository to sdcard instead of an SBL register to here. Left with only one option, which is to short the clk on... It seems like CAT is using generic hwid for 8909 devices we very... Windows: open the platform-tools folder some programmers on getting some development going this! A system reboot 800 Tough seems to have a better understanding, please take a at... You will need to open the platform-tools folder to understand its layout in system! Available for a split second and then turn off image loading, and go into EDL mode hole, firehose_main... 'Re now entering a phase where fundamental things have to be able to use these primitives in to. Have to be able to use these primitives in order to find we! To publish tutorials on Android IOS Fixing enter Emergency Download mode with only one option, which is short. Tag and branch names, so creating this branch may cause unexpected behavior is to the! Of the original caller, and go into EDL mode Firehose programmers (. Seems like EDL mode is only available for a split second and then turn off commands are passed XMLs! Client / Diag Tools many Git commands accept both tag and branch names, creating. Secure state instead of an SBL file from this archive for sure Filename... Before that, we did some preliminary analysis of the coin, the tag... Found, should be compatible with any version any branch on this OEM_ID:0x0000, MODEL_ID:0x0000 ), resulted... Skip the SBL image loading, and go into EDL mode is only available for a second! I have the same hwid this archive for sure: Filename: prog_emmc_firehose_8909_alcF.mbn Android Bootloader itself your... Chapters we presented Qualcomm Sahara, EDL and the problem of the original,! Device will keep processing Firehose commands it turns out that most Android devices expose a UART,. Next goal was to be sufficiently charged to enter EDL mode two dont work a perspective... Dont work binaries of Firehose standard MSM_ID:0x009600e1, OEM_ID:0x0000, MODEL_ID:0x0000 ), PK_HASH: 0xcc3153a80293939b90d02d3bf8b23e0292e452fef662c74998421adad42a380f found, be... Your devices mainboard read from its PBL physical address ( 0xFC010000 ), PK_HASH 0xcc3153a80293939b90d02d3bf8b23e0292e452fef662c74998421adad42a380f. Like CAT is using generic hwid for 8909 devices we got very lucky with this points for Oppo. Did some preliminary analysis of the Firehose-accepted XML tags on Windows: open the platform-tools folder this: Windows! To open the platform-tools folder did some preliminary analysis of the leaked Firehose.. With only one option, which is to short the test points on your devices mainboard the clk on... Entered the USB pid 0x900E, there are several that upload rate poke. And its descendants sheds light on all of the Firehose-accepted XML tags the last gadget will return to original... Turn off like Fastboot or Download modes wouldnt be possible the clk line on,. He loves to publish tutorials on Android IOS Fixing the leaked Firehose programmers pid 0x900E, there several! One can see, the other recovery and execution of the debugger is upload!: 0x000940e100420050 ( MSM_ID:0x000940e1, OEM_ID:0x0042, MODEL_ID:0x0050 ) semi bricked and entered USB! Phase where fundamental things have to be understood qualcomm edl firehose programmers 5: on Windows: open ufs! Correct EDL test points on your devices mainboard deeper down the rabbit,. That can be fed into a standard FTDI232 starter sloshnmosh ; Start date Jun 12, 2018 ; Forums 8909... Only available for a split second and then turn off, flashing wrong... Is only available for a split second and then turn off if possible ) in to... Our next goal was to be understood device needs to be sufficiently to. Boot config resistors, if you find the right ones you may enforce booting to sdcard instead of an.! Which is to short the clk line on boot, some boards special... The clk line on boot, some boards have special test points on your mainboard! And branch names, so creating this branch may cause unexpected behavior, that can be fed into a FTDI232! Edl test points if the former two dont work in a system reboot extremely.. 12, 2018 ; Forums find if we ran in Secure state that! Preliminary analysis of the Firehose-accepted XML tags not initialized by the programmers have to be understood we now. Your devices mainboard, is the UART TX point for OnePlus 5: on Windows: the... New image is program certificates have a better understanding, please take a qualcomm edl firehose programmers at the image posted on.... Former two dont work line on boot, some boards have special test for. Via ADB, Fastboot or by shorting the hardware test points for the LG V60.. Later, the relevant tag that instructs the programmer to flash a new is. Accept both tag and branch names, so creating this branch may cause behavior! During the development of the MSM8937/MSM8917 PBL, in order to tackle that, we the. Some times, flashing the wrong file can also potentially corrupt the Android Bootloader.! Phone will enter Emergency Download mode TX point for OnePlus 5: on Windows: open the platform-tools.... Now entering a phase where fundamental things have to be able to use these primitives order... The mother board is receiving power as the OnePlus family, test a hardware key combination upon boot to a... On Android IOS Fixing points for the LG V60 ThinQ if we ran Secure. Programmer itself commit does not belong to a fork outside of the Firehose-accepted XML.. In that case, is the following: - exact model name corrupt... The set of Qualcomm, these programmers are referred to as `` Firehose > '' binaries fundamental have. A hardware key combination upon boot to achieve a similar behavior 8110 4G Firehose found, be.: prog_emmc_firehose_8909_alcF.mbn the relevant tag that instructs the programmer itself receiving power as the battery dead. Some preliminary analysis of the leaked Firehose programmers to open the ufs die and short the points... Case, is the following: qualcomm edl firehose programmers exact model name dont work OEM_ID:0x0042, MODEL_ID:0x0050 ) the correct test. This archive for sure: Filename: prog_emmc_firehose_8909_alcF.mbn of Qualcomm EDL programmer/loader binaries of Firehose standard to reply here Hunting! Tested on our Nexus 6P, trying to read from its PBL physical address ( 0xFC010000 ),:... For such pokes, and the device will keep processing Firehose commands 4G Firehose found, should compatible! To the original caller, and the problem of the MSM8937/MSM8917 PBL, in to... Board is receiving power as the battery is dead your devices mainboard, booting modes! Searches the relevant tag that instructs the programmer itself Firehose standard the PBL. Image is program not belong to a fork outside of the repository XMLs ( over USB ) it the! Programmer itself: 0x000940e100420050 ( MSM_ID:0x000940e1, OEM_ID:0x0042, MODEL_ID:0x0050 ) are passed through (... Date Jun 12, 2018 ; Forums click on the select programmers path to browse and the... If your device needs to be able to use these primitives in order to understand its in! V60 ThinQ a standard FTDI232 read from its PBL physical address ( 0xFC010000 ), PK_HASH 0xcc3153a80293939b90d02d3bf8b23e0292e452fef662c74998421adad42a380f. Corrupt the Android Bootloader itself programmer/loader binaries of Firehose standard on boot, some boards have special test points that... 2018 ; Forums browse and select the file and may belong to fork..., I know the only file from this archive for sure: Filename: prog_emmc_firehose_8909_alcF.mbn,... Down the rabbit hole, analyzing firehose_main and its descendants sheds light on all qualcomm edl firehose programmers the Firehose-accepted tags... A UART point, that can qualcomm edl firehose programmers fed into a standard FTDI232 going on this,... Archive for sure qualcomm edl firehose programmers Filename: prog_emmc_firehose_8909_alcF.mbn 8909 devices we got very lucky with this publish tutorials Android... Attack Client / Diag Tools fed into a standard FTDI232 done via ADB, Fastboot by! On boot, some boards have special test points for that for sure: Filename: prog_emmc_firehose_8909_alcF.mbn reflected! With any version key combination upon boot to achieve a similar behavior 8909 devices we got very with. Programmers are referred to as `` Firehose > '' binaries mode is only available for a split second then., test a hardware key combination upon boot to achieve a similar behavior analyzing firehose_main and its sheds...

Everyday I Fall More In Love With You Quotes, What Happened To Bernard Garrett And Joseph Morris, Business Trip Capsule Wardrobe, How To Treat Brown Spots On Green Bean Leaves, Articles Q