yashsingh1/xdaforums huggingface dataset:
[LG V10 Q&A, Help & Troubleshooting] WillyPillow:
Personally, I injected the H901 aboot into an H962 DZ and flashed it onto my device a few months ago.

Long story made short, it was completely bricked, even without 9008 mode. I recommend you guys to be cautious with this method.

Edit: As I can understand Chinese, I'm currently looking into the tutorial.
[LG V10 Q&A, Help & Troubleshooting] emdroidle:
Useful, though I cannot speak to the reliability of that information. A different source has a tool they say comes from Qualcomm, which may be more reliable with newer devices. Please note, this is a source of claims, I don't know how reliable they are (they also don't provide much detail on the limits of the tool).

I look forward to more detail/reports from that tutorial. Exact details would be invaluable.

I hoped that would work, but I feared the above possibility. The problem is which portions of the flash image sign which other portions of the image, and how many different keys does LG use? Your observation seems to suggest either the key used for signing the H901 aboot was not honored by the rest of the H962 firmware, or the key used for signing the H962 kernel wasn't honored by the non-unlocked H901 aboot (or both).

If the former case, then which are the pieces prior to aboot and can only those pieces be transplanted from a H901 while still preserving the dual-SIM functionality of the H962 (and H961N)? If the latter case, then I suspect you merely need to run a H901 kernel long enough to unlock the bootloader, then you can put back the H962 kernel and run that with the unlocked bootloader.

The other question is, which portions of the data unlock the bootloader? Is it a small change to the aboot portion? Is it changes elsewhere? Can those changes be isolated from the rest of the H901 firmware?

Just in case you didn't notice, I've got lots of questions. :) I hope I can figure out answers to some, but others I may not be able to answer. I'm currently targeting the kdztools portion.
[LG V10 Q&A, Help & Troubleshooting] WillyPillow:
[MENTION=6984210]emdroidle[/MENTION]

TBH I don't see anything not mentioned already. Basically the process is just

Flash 5.1 rooted -> modify build.prop -> flash H901 KDZ

Personally, I'm not going to do more risky experiments since I already RMA'd my last hard brick :(

Also, you might want to use IDA to take a look at aboot, which is basically an ELF binary. I had been doing that, but stopped after the brick.
[LG V10 Q&A, Help & Troubleshooting] emdroidle:
I understand. You're in a better position since LG will honor the warranty on your H962. They're a bit tougher if you get one outside Taiwan. :)

I was fearing we would have to take that approach. Worse, it looks like the firmware updates change aboot, which suggests settling on one version and trying to crack that is best. I wanted to try Plasma, but IDA is likely far enough ahead to beat Plasma. I'm just glad IDA has a Linux version.
[LG V10 Q&A, Help & Troubleshooting] emdroidle:
After some thought, I realized I should ask for some detail about the failed process you used for this. Did you flash both the aboot and abootbak slices? (/dev/mmcblock0p9 and /dev/mmcblock0p15 if I recall correctly)

If you flashed only aboot and ended up bricked, this seems to suggest it did in fact successfully execute the H901BK aboot, but the aboot decided the signature on boot was incorrect and halted. In this scenario if the portion before aboot had decided aboot had a bad signature, then it should have restored abootbak, which likely would have successfully booted the H962 kernel.

If you flashed both aboot and abootbak, this suggests the portion before aboot decided aboot's signature was wrong and it halted there. This doesn't rule out it successfully executing aboot and aboot deciding boot had the wrong signature, but it makes that less likely.

Hate to say it, but flashing only aboot doesn't really give us much information on the likelihood of flashing a full H901BK image onto a H962 being successful or not. The problem is there could be signatures in many places and any one of those could fail yet reproducing the original scenario would work perfectly.
[LG V10 Q&A, Help & Troubleshooting] WillyPillow:
Hmm, I've never thought this deep. I was just like "Sxxt, my phone bricked! Must be a bad signature somwhere..." and stopped messing around with it :(

To answer your question, I only flashed aboot, without anything else. And for the details of the brick, you can't even see the "powered by Android" bootloader screen. The device just viberates if you want to turn it on. The only way to make the screen display something is remove the battery and connect it to a computer, for which a "no battery" icon is showed. So my guess then was the aboot signature was invalidated. But now you reminded me the existance of abootbak...

I'll do some research and thinking right now :D
[LG V10 Q&A, Help & Troubleshooting] ivangundampc:
Well, i think that you have bricked your phone into the "Qualcomm HS-USB QDLoader 9008" mode

The phone should be able to fix if you can see "Qualcomm MMC Storage USB Device" in "Devices Manager" when the phone is connecting to the computer.
[LG V10 Q&A, Help & Troubleshooting] emdroidle:
I was thinking about it, since I would very much like to somehow unlock the bootloader. While this way may or may not be tweaked to work, it does sound plausible. Analyzing failures can be very valuable.

So this may suggest aboot successfully executed, but found a mismatched signature and halted. At which point, flashing the H901BK aboot and boot may be enough to make this work. This may though also require the H901BK recovery image. I do not know where the unlock process actually does its magic, so part of it could be in recovery.

I'd love to hear if you can get it to be successful.
[LG V10 Q&A, Help & Troubleshooting] emdroidle:
Two threads relevant to this topic have shown up.

First, apparently someone somehow managed to accidentally flash a H901 firmware onto a H960A. That person was looking for help with restoring their device, but it leaves me hopeful this method could in fact work on other devices. Most likely you'd end up with a mix of some portions of the flash being copied from a H901 and some from whatever your phone is normally supposed to run, but this does confirm it is possible to run H901 firmware on other devices.

Second, a method has been found to recover devices from Qualcomm 9008 mode. This is big news since it greatly lessens the danger of a bad flash. Problem is it requires root on the phone to generate the initial image, though I suspect the images produced by my kdztools may well work for the job too.
[LG V10 Q&A, Help & Troubleshooting] emdroidle:
I very much want to unlock the bootloader of my device, so I'm still doing research trying to estimate how plausible this method is. At this point there are enough reports of wrong V10 device images not being fatal to other V10-type devices for me to consider this method "likely".

Examining KDZ files for several devices, there is quite a bit of overlap between device images. There are 9 slices though which seem to warrant special attention based upon them having backup copies. These are named "sbl1", "pmic", "hyp", "tz", "rpm", "aboot", "sdi", and "raw_resources".

My guess is install a H901 image, do `fastboot oem unlock` and then you can copy everything aside these slices from your original device. My concern is these may need to remain the H901 versions in order to remain unlocked (unless all V10 devices share the unlock method, which may or may not be the case).

It may also work to use my KDZ Tools to copy the PrimaryGPT and BackupGPT areas from the target device onto a H901 image, at which point the process could be done without even needing a factory reset!

I'm pretty sure "sbl1"/"sbl1bak" are the first-stage bootloader. All the others aside from "raw_resources" look to be ELF executables.

Open request to Qualcomm here, could you please make your chips either alternate between trying to boot off of "sbl1" and "sbl1bak" (a single MRAM or PCRAM cell should take too much space, should it?), or else make them randomly choose between booting off them upon power-on? Too often one or the other gets corrupted in such a way that booting fails, but either isn't so corrupt to trigger them to try the backup, or else the primary is so badly damaged it is unable to try the backup. Alternating (and passing to the Linux kernel which one it successfully booted off of!) would greatly increase the chances of successful recovery without specialized tools.
[LG V10 Q&A, Help & Troubleshooting] emdroidle:
Wiki + Likelyhood evaluation

Having examined the situation enough, I'm pretty sure this method should work. Experimentation though is risky.

I'm now working on creating 2 software tools for this project. One is a simple tool to remark the device a KDZ is for. This is pretty simple and the reports are, once this is done LGUP will happily flash a KDZ onto other devices. The second goal is a tool for modifying the GPT afterwords. While the H901 has a GPT similar to other V10s, it isn't quite identical. Of major note, many other devices have a /cust partition which has some extra software.

These two tools may actually be unnecessary. My KDZ Tools expose all of the data in an inconvenient, but workable format. The KDZ Tools can also be used to replace the GPT for the H901 with a GPT from another device, and they also expose the areas which mark which device a KDZ is for. Problem with using the KDZ Tools for this is there is what looks to be an extra checksum, and I've got no idea whether it covers the GPT (I hope not, but...).

I'm now looking to create the above two tools on GitHub, the LGE Tools. Alas, what may be more valuable is the Wiki on GitHub. I've got speculative instructions a little ways from the top. Towards the bottom I've got a list of which areas you'd need to restore from your original device. I guess I'm a bit unsure of "persist", the content is identical for my device, but the differing timestamps might trigger a flag that something has happened.

Hopefully we can get some testers who can risk needing to RMA their devices (I hope they don't need to, but this IS risky).
[LG V10 Q&A, Help & Troubleshooting] ivangundampc:
Wow, i am very surprised that you are still working on this method! :) You have really paid a lot of effort on it!

After taking a look on your works, i really think that this method may really works to help us to unlock the bootloader.

In fact, the T-Mobile variant of both G5 and V20 have bootloader unlocked and so other version of G5 and V20 may also be able to unlock their booloader through a method like this, therefore, I think we should be able to draw more attention (more devs?) on studying this method.
[LG V10 Q&A, Help & Troubleshooting] emdroidle:
What we really need is a pool of testers who are in an area which gets warranty coverage and are able to survive being without their phone for a few days. We could even have a fund to cover charges for bricking devices. Problem is to ensure people don't fake reports of trying and failing.

The G5 and V20 could be rather more entertaining. On the V10 all of the on-board flash is seen by the kernel as a single region. On the G5 and V20 it appears divided up into several devices and depending on how that works images from one phone may be far less portable than they were with the V10.

The complicated steps reported at the start may have been needed for one of the Korean variants (F600x devices). They've got slightly differing sizes of on-board flash from the other V10s.

One portion of the LGE tools is done. Download a H901 KDZ file, then run `chkdzdev -s H961N H90120e_00_0316.kdz` and the file will be marked as for a H961N. You'll then have the difficulty that dual-SIM functionality won't work, but you could at least prove it is possible to install a H901 image onto a H961N and still have it boot. (I'd recommend downloading a H961N KDZ file and being prepared to mark that as being for a H901 in order to reinstall a working image)
[LG V10 Q&A, Help & Troubleshooting] ivangundampc:
I am curious that what will be done on the kdz after executing the above command. Is that merging those partitions like you have mentioned in the wiki page? Is the modified kdz promised to be bootable (at least it will boot with some lost of functionality and not bricking the phone)? Also, is there any possible way to fix the phone from bricked?

I was hesitated to try this because my phone has no warranty anymore. Have you tried it with your V10 before?
[LG V10 Q&A, Help & Troubleshooting] emdroidle:
Absolutely no guarantees. Thank you for asking!

I'm still building up the nerves to actually try it. I'm optimistic it will work, but not to the level of confidence I like. Remarking the KDZ is reliable, that is a simple operation and doesn't modify anything that is verified. The question of bootable is are the V10 KDZ files truly as device inter-compatible as reports indicate? This should be the case (it would be beyond expensive for Qualcomm to make individual variants of the 808 for each device), but... Do you have any idea how much it would cost if it did brick? (I've got no idea of repair costs)

The most likely lost functionality would be losing support for the second SIM, that is why I'm aiming to fix /cust (most likely problem point).
[LG V10 Q&A, Help & Troubleshooting] ivangundampc:
I believe that only modify the model number of the kdz is not enough for booting. People in the Chinese forum(the link that i posted at the first post) did the same things, tried to flash the H901 kdz and finally made their phones bricked. Therefore, as you have mentioned, we need to do somethings more (like merging some partitions) in order to make the H901 kdz boots on H961N or other variants.
[LG V10 Q&A, Help & Troubleshooting] emdroidle:
Isn't the F600S a Korean model? The most likely issue for a F600S is all the F600x devices include a slightly different amount of on-board flash. As such the layout might be just different enough to require hacks to get it on.

In other news though, after some thought I have managed to come up with a brick-resistant method of halfway installing the H901 bootloader. No guarantees here either, but should be less likely to generate a hard-brick. I'd love to read a report of someone using this method successfully, but I'm still merely theorizing based upon the reports I've read.
[LG V10 Q&A, Help & Troubleshooting] curtislin:
I had successfully converted F600S to H901 using the procedures mentioned. The phone boot normally and become rooted h901, but unfortunately network locked by T-Mobile is reported. I had try device unlock through wifi failed. Any idea to SIM unlock T-Mobile phone?
[LG V10 Q&A, Help & Troubleshooting] ivangundampc:
Which procedure have you used? The one posted by me or mentioned by emdroidle?
[LG V10 Q&A, Help & Troubleshooting] curtislin:
the document from china website

http://pan.baidu.com/s/1c1U1lVa
[LG V10 Q&A, Help & Troubleshooting] shadi47pk:
can u please share the document i am unable to get it.:o
[LG V10 Q&A, Help & Troubleshooting] samy2015:
did someone got the files emmc_firehose_msm8992.mbn & rawprogram.xml ?
[LG V10 Q&A, Help & Troubleshooting] aaya888:
[youtube]Rnz7-3NE4uk[/youtube]&t=6s it is qualcomm 9008 unbrick
[LG V10 Q&A, Help & Troubleshooting] awloelxf:
One more way to unbrick from 9008 on aryk. tech. in unbrick files section

Use LG V10 Loader.img to load phone from sd card

Want to try bootloader unlock method on my h961n, but want to have unbrick tools before :)
[LG V10 Q&A, Help & Troubleshooting] samy2015:
Thanks alot i already brick my phone many times & fix it with your files trying to get root

Mine is f600l running 7.0

So did someone have a working method for rooting f600l
[Pixel C Android Development] ggow:
[COLOR="gray"][/CENTER]
/*
* I am not responsible for bricked devices, dead SD cards, thermonuclear war,
* or you getting fired because the alarm app failed.
* Please do some research if you have any concerns about features included
* in the products you find here before flashing it!
* YOU are choosing to make these modifications.
*/
[/COLOR]

General Information

These builds are based on CM-13.0 nightlies with features cherry-picked from many sources including AOSP, crDroid, OmniROM, SlimROM, LiquidSmooth, SpasilliumNexus, DirtyUnicorns, NamelessROM, AICP, Euphoria-OS, TeamBliss, PAC, etc. This is similar to a nightly from CM but has some extra goodies baked in.

Features

Does NOT force encryption of /data partition

Ambient Display

Floating Windows

Statusbar Customizations

Clock Alignment

Battery Settings

Charging animations

Dotted circle battery settings

Battery colours

Battery bar

Statusbar greeting

Network Traffic

Statusbar Brightness control

Breathing Notifications

Quick Pull down

Smart Pull down

Quick Settings Management

DPI Settings

Live Display

Ambient Display

Doze

Smart cover options

Lockscreen weather

Lockscreen colours

Middle and bottom shortcuts

Button Settings

Navigationbar customization

Slim PIE

Gesture Anywhere

TRDS

Navigation ring Targets

Animation Controls

Slim Recents

Omni Switch

Recents RAM Bar

HeadsUP Settings

App circle sidebar

Apps sidebar

many many more....

Prerequisites for Installation

- Must have an unlocked bootloader

- TWRP installed

- If you haven't already done so flash the lastest vendor.img (MXC89L) linked in the Downloads below

Fresh Installation

- Backup your existing ROM first

- Perform a factory reset

- Flash the ROM File

- Flash Gapps of your choice (any arm64 6.0 version)

- Reboot

- Enjoy!

Downloads

*** Please do NOT create any mirrors ***

- Temasek's CM-13.0 for Pixel C

- MXC89L vendor.img

Source Code

- Kernel Source

- Device Tree

- Vendor CM

Credits

@temasek

@arter97

@nychitman1

Cyanogenmod

Google

CAF

XDA:DevDB Information

CM-13.0 temasek, ROM for the Google Pixel C

Contributors

ggow

ROM OS Version: 6.0.x Marshmallow

Based On: Cyanogenmod

Version Information

Status: Stable

Created 2016-06-18

Last Updated 2016-08-06​
[Pixel C Android Development] ggow:
Release Notes / Changelog

08 Aug 2016

- August 2016 Security Patches Included

08 Jul 2016

- July 2016 Security Patches Included

28 Jun 2016

- Merged 2554 commits from Google's "chromeos-3.18" kernel branch into cm-13.0 kernel

20 Jun 2016

- Fixed installation getting stuck

18 Jun 2016

- Initial Release
[Pixel C Android Development] sxg75:
[MENTION=5749760]ggow[/MENTION] trying to flash... but same problem as in http://xdaforums.com/showpost.php?p=67374029&postcount=71
[Pixel C Android Development] redukt:
Is it necessary to flash the vendor.img from the MXC89H or could we use the newer one (NPD56N)?
[Pixel C Android Development] ggow:
Need to use the MXC89H vendor.img
[Pixel C Android Development] ggow:
Ok, thanks for letting me know, will look into it ASAP.
[Pixel C Android Development] redukt:
Got the same issue "detected filesystem ext4 for /dev/block/platform/700b0600.sdhci/by-name/APP" :/

Back to DU...
[Pixel C Android Development] king tsoi:
Same issue "detected filesystem ext4 for /dev/block/platform/700b0600.sdhci/by-name/APP" :/
[Pixel C Android Development] ggow:
Just out interest when you tried to flash CM were you coming from DU?
[Pixel C Android Development] redukt:
Came from this one:

DU_dragon_6.0.1_20160617-0806.v10.3-WEEKLIES.zip
[Pixel C Android Development] sxg75:
Even though I was not addressed directly... I had been coming from N4 preview, then downgraded to current MM using flashable zip of combined system+vendor.
[Pixel C Android Development] ggow:
New Build is Up

- Dated 20 Jun 2016

- Fixed installation getting stuck

- Using the recovery by [MENTION=2489052]NYCHitman1[/MENTION] posted here.
[Pixel C Android Development] king tsoi:
flash this recovery first then flash the rom as normal?
[Pixel C Android Development] ggow:
Yes, flash the recovery. Then flash the ROM as you would for clean installation.
[Pixel C Android Development] king tsoi:
Hi, i've flashed the recovery ( which is the same one that i had 3.0.2-0) did a factory reset in twrp and got the same error.

It was running the stock MXC89H, rooted using the forum method.

Thannks
[Pixel C Android Development] ggow:
- I was running MXC89H factory image

- Factory reset

- Flash ROM

- Tested it a number of times coming from MXC89H and DU, seems to work everytime here

- Could you post your recovery log?
[Pixel C Android Development] king tsoi:
Sure, i just tried it again, maybe i should do a clean install of factory image and try again?
[Pixel C Android Development] ggow:
Could you post the actual recovery.log file

There is usually more info than the screenshot can provide
[Pixel C Android Development] ggow:
Looks like you flashed the wrong build, not the new one
[Pixel C Android Development] king tsoi:
oh no! forgive me, i didn't realize there's a new build, just finished downloading the latest one, will try it soon.

one more question, can i restore the data partition from my last rom to get the apps back?

many thanks
[Pixel C Android Development] ggow:
No harm done :)

Yes restoring your /data partition should work fine
[Pixel C Android Development] king tsoi:
The latest build worked! thank you! I didn't restore the data partition.

So far everyting works great, keyboard works right out of the box.

i wasn't able to pick up my 5ghz wifi signal at first, only 2.4 ghz but it works fine

after i switched the wifi region code to taiwan.

exfat otg worked with super su, paragon and stick mount installed.

The multi window mode which is kind of working in the cm13 rom doesn't seem to work.

I also don't see any option of Floating Windows, would you mind letting me know how does it work?

Anyway, Great rom! Way better than stock! Thanks for the great work!

Updates:

1. WiFi got weird after a reboot, wifi region code roll back to Europe, I can still change it but once I leave the advanced option, it will become Europe again.

2. Can't sign in to Google now, i've entered the google account on start up, but Google now still asked me to sign in, when I entered my email, it said account already exist. I was able to fix it by removing my Google account in setting, and sign in in the google now app, but after a reboot it asked me to sign in again.

3. Can't download (Google play game) in play store, got error -505, installing the apk works fine tho. Didn't happen to other apps .
[Pixel C Android Development] brando56894:
The ROM works well, I've been using it the past few days. The only problem that I have is that my bluetooth keyboard disconnects after about 60 seconds of not being used, instead of the usual few minutes.
[Pixel C Android Development] ggow:
- I'll try and find out why that might be.

- Which bluetooth keyboard are you using?

- Do you know how long it takes to disconnect automatically in Stock Android?
[Pixel C Android Development] brando56894:
It's a dual radio keyboard I got off of Amazon for $35. It's called the Nulaxy M4 or something. It usually takes about 5 minutes to disconnect. I can try it with the Google Folio cover also to see if the same thing happens.
[Pixel C Android Development] ggow:
New Build is Up

- Dated 28 Jun 2016

- Merged 2554 commits from Google's "chromeos-3.18" kernel branch into cm-13.0 kernel
[Pixel C Android Development] ggow:
New Build is Up

- Dated 08 Jul 2016

- July 2016 Security Patches Included
[Pixel C Android Development] rickylamceo:
I have been using Temasek's UNOFFICIAL Build on my Samsung Galaxy S5 and Note 3 :)

you guys did an amazing job on both of them :)

so, I figure why not give it a try on my Google Pixel C

I am sure New Build with August 2016 Security Patches included will be up very soon

Thank you very much in advance :)
[Pixel C Android Development] ggow:
New Build is Up

- Dated 08 Aug 2016

- August 2016 Security Patches Included

- Lastest vendor.img (MXC89L) is linked in the OP
[Pixel C Android Development] ravn83:
hey ggow,

re u working on an update of the rom with the september security update?

it would be really great :).

greetz,

ravn
[Pixel C Android Development] ggow:
Yes, I am working on it. Haven't had much time, but will be out soon [emoji6]