[AT&T LG G4] bethnesbitt:
Unbrick LG G4 H811 qualcomm 9008

I've been trying to unbrick my H811 and have tried many methods. The first time I used the singleimage.bin, it worked perfectly. This was because the bootloader was unlocked at that time. After relocking the bootloader, tried flashing an extracted kdz, which would be at that point a .dz, using LGUP. BTW this works, meaning, it will flash but will also brick. So far what I have discovered is:

When imaging the dump to the sdcard, the board pinout is what matters. The partition from the singleimage.img partition works, so I extracted just the partition and have tried stock KDZ from 20o and 20P, same secure 1006 error. Have the 20i kdz now, going to try that next and will report back. Here are the instructions for anybody who wants to work on this as well.

If you dump a kdz and use the dd command to dump the PrimaryGPT.bin to the sdcard, the partition is different from the singleimage partition and does not work. Attached is the dump of the singleimage partition only, if you use this, Linux users can use this method, also attached is a modified script that works with newer KDZ. Linux is easier because once you dd the partition to the SDCARD, you can

sudo gdisk -l /dev/sdX

sudo dd if=/dev/zero of=/dev/sdX#

each individual partition and try other extracted KDZ without having to continually zero out the entire sdcard.

First dd the attached partition file to a sdcard, you can also use winimage to flash just the partiton to a sdcard, there is a emmcraw tool as well out there that lets you flash each .bin for windows users, one by one, if you want to search and play around with it.

Next extract the kdz then dd each .bin to each partition manually, EXECPT the PrimaryGPT, this partition is different and does not work, there is no response from the phone once you insert the SDCARD. When dding the attached partition to the sdcard then individually dd each .bin:

sudo dd if=modem.bin of=/dev/sdX1

sudo dd if=pmic.bin of=/dev/sdX2

sudo dd if=sbl1.bin of=/dev/sdX3

etc... note, system is not necessary, we are trying to get into download mode or recovery.

In end, still not sure if it matters using a actual dump from a like phone with a unlocked bootloader will work or not, think so far it matters that the bootloader on the actual physical device is the problem, not sure as of yet since all the dump files are locked bootloaders. If a locked bootloader on the actual phone is the issue, then finding a way to erase the EMMC, or, getting the phone in 9006 mode to delete each partition and then manually flashing the .bins would be the next option.

20I KDZ doesn't work, tried with both PrimaryGPT extracted from the kdz extract tool and the one attached in this post, no response from phone. So far, the only ones that work are 20o and 20p with the attached partition. About two weeks ago Tmobile released a Q version, was going to update later, but once became bricked was unable to. If somebody has a stock Tmobile phone and wants to update via LG Bridge, while the KDZ is downloading one can simply copy and paste the KDZ before the update completes and deletes the KDZ.

The H811 20o/20p/20q work, if you download and extract the 20q KDZ from here, and use the attached tool to extract the KDZ, then dd the partitions as instructed, the device will give a response. Sad part, once the SDCARD is in the phone your PC is not detecting it via USB.

Also ended up buying a six month subscription just to get these files, supposedly you can unbrick via qfil, thing is not sure if the prog_firehose_emmc_8992 for these devices matter or not. Did do a bit of testing using different versions of the qualcomm hs-usb 9008 drivers and did get different responses with qfil. For example, and older version gave me an error much more faster then a newer version of the driver.

Also was able to to get the .tot files which is included with the qfil files. Anyways, if you use a hexeditor program, you can easily convert the .bin to .mbn by opening each extracted kdz and saving it as, example, from aboot.bin to aboot.mbn, which is the exact same process, just a bit more tedious. Tested the TOT for the H811, it is legit, after extracting it using boarddiag, dded each bin to a sdcard and got the same response, secure error 1006, if it were anything else would not have worked.