yashsingh1/xdaforums huggingface dataset:
[G4 General] xVANKO:
Temporarily Locked - until I prepare complete method​

!!! WARNING !!!

This method is currently in testing

Do this at your own risk! I'm not responsible for bricks.

Read and follow this steps correctly!​

Description:

Regarding OllieD thread (available in Credits) he found that bootloader have several references in persistent partition which was correct. I was trying to continue his research and I found that before unlock and after unlock some partitions not included in KDZ files are modificated by unlock.bin key.

This partitions are: cust, drm, misc, modemst1, modemst2, mpt, persistent and sns. I knew that drm, modemst1, modemst2, mpt and sns partitions cannot be important in unlocking / locking process so I was able to check 3 partitions which was CUST, MISC and PERSISTENT.

This first contains informations about whole boot process like boot image, boot procedure and also information about bootloader state which is visible on the top of the screen while bootloader is unlocked.

Second partition is the most important - it contains DEVICE-ID needed to unlock device and real bootloader state which can be check using "fastboot getvar unlocked" and also used unlock.bin when bootloader is unlocked. There are some references between this partitions which check them both so this partitions MUST be flashed together.

Persistent partition contains procedure for unlocking bootloader (parse command to flash unlock.bin) so we dont need to flash it - but if you want, you can ;)

Result of relock:

- "Bootloader Unlocked!" message disappear while booting. (CONFIRMED)

- "fastboot getvar unlocked" returns "no" (CONFIRMED)

Requirements:

- ADB and FASTBOOT

- ADB Driver installed

- LGUP (which can be downloaded from here)

- LG_ROOT (which can be downloaded from here)

After relock, you can use the same Unlock Key which was used to unlock bootloader for the first time (this one from official LG Bootloader Unlock Site)

INSTRUCTION:

IN PREPARATION...

Video (Prove - not instruction):

[YOUTUBE]Jh6wNwRWF0M[/YOUTUBE]

WARNING! DONT TRY METHOD SHOWED IN THIS VIDEO FOR THIS MOMENT !!!

COMMANDS USED IN THIS VIDEO ARE DEDICATED TO H815 EU VARIANT

IF YOU DONT HAVE THIS VARIANT, THIS COMMANDS CAN HARD-BRICK YOUR PHONE!!!
​

Credits:

- OllieD (for: Relocking Bootloader May Be Possible...)

- shakeyabooti (for: "LGUP - NEW!!! - INSTALL KDZ - MM or LP - FACTORY RESET/UPGRADE")

- thecubed (for: "[ROOT] TMO/VZW/ATT/SPRINT/INTL Root your LG G4 with Low Effort Root!")

- Unjustified Dev (for: "[GUIDE] New Root Method for LG Devices")

- dominik-p (for: "[How to] Determine dd Parameters For All LG G4 Models")

- leptdre (for: "Unbrick LG G4 H815 9008 Qualcomm")
[G4 General] Avantu:
You are the man if it works!
[G4 General] uio88:
Oh man,big up for u! :)
[G4 General] polfrank:
Uhmm.... Does this mean that... if we get the bootloop issue.... we will be able to relock and send back to LG for warranty purposes???!?!? :D

(I mean, if it's really shown as locked in every possible aspect, after relocking...)
[G4 General] xVANKO:
Yes, but you don't need to.

I had bootloader unlocked, and LG repaired it under warranty ;)

Just place LG G4 motherboard to your cooker, 200 celsius degrees for 10 minutes and device is broken forever without any traces - send it to them, tell "i dont know what's happened - just bootlooped and now died" - and voilÃ*. They replaced motherboard and after 2-3 days, i got my LG working without any bootloop (and with locked bootloader). And of course for free :highfive:

So, I've just extracted all partitions "BEFORE" unlocking bootloader, then i unlocked it, again extracted all partitions to make a HEX compare, and that's it - just flash important (2 or 3) partitions from state BEFORE bootloader was unlocked and wow - relocked, unlocked, again relocked, unlocked - no crash, no brick, working as hell.

And as I wrote:

There is no information while booting about unlocked bootloader, and also fastboot command "getvar unlocked" returns "no" - so official command to check bootloader state returns that bootloader is locked. I don't know is there any other method of checking bootloader state but it seems to be fully locked.

The biggest problem for me is 1 of this important partitions - becouse, what if this partition contains DEVICE-ID needed to unlock bootloader. If you relock it using my method, probably your phone will get DEVICE-ID of my phone - which can be easly detected by LG Support. I need to check some things before I make this release.
[G4 General] ObiDanKenobi:
Well, one option would be to create a script for those that did not unlock yet, so they save the 3 partitions and then they can happily unlock, knowing that they can relock. What do you say about this as a partial solution, if some device dependent information is stored in those partitions.?
[G4 General] xVANKO:
First partition store data which customize boot screen (like boot logo, information about bootloader lock state, etc). Second partition store bootloader extra configuration like used unlock key, real unlock state. Third partition is unknown for me at this moment. For sure, people with locked bootloader will have the most secure way to relock it after unlock - just using their own partitions dump - not shared and published for all. If second partition does not contain informations about DEVICE_ID, there wiil be only one simply method to relock bootloader again.
[G4 General] petro_ionut:
Locked bootloader for 1,5 years, so this will be huge for me, finally unlocking the bootloader and back again in case of something happens! Great....
[G4 General] Minto107:
Oh man! If you'll do that and it'll be working 100% I will try to donate to you for that! I wanted to unlock my bootloader but I was always worried about some problems that I might get

Wysłane z mojego LG-H815 przy użyciu Tapatalka
[G4 General] ObiDanKenobi:
All the people are worried about warranty in case of a bootloop. How would you revert the 3 partitions content when the phone is bootlooping and you have access only to send_command.exe?
[G4 General] undef1ned:
Oh, while my G4 is still in the owen now, I'm reading this thread :) H815 506 bootlooped this April. Warranty repair rejected. Worked with big-core disable tool for 6 months, until it finally died today.

Ok, if it is not finally dead after baking in the owen, then I will try to lock again and give it to the repair
[G4 General] Minto107:
Now I'm just waiting for proper LG G5 Port until Nougat is released [emoji14]

Wysłane z mojego LG-H815 przy użyciu Tapatalka
[G4 General] polfrank:
Maybe you can flash the kdz that disables the big cores and then you have a properly working phone, where you can do anything you like, such as relocking the bootloader...
[G4 General] xVANKO:
You can import partition files to sdcard and flash it via send_command - and bootloader will be locked.

As I wrote, I had bootloader UNLOCKED and i LG repaired my phone under warranty - i just destroyed it completly in the cooker and sent it to them just telling "i dont know whats happen, just bootloped and now died" - they wouldnt able to check bootloader state so ... >:D
[G4 General] undef1ned:
I've bought mine in Poland. Unfortunately sent to repair with "Bootloader Unlocked" message on, just read several forums (including forum.android.com.pl) and some ppl shared positive experience of the unlocked phone to be fixed. Not sure if I can apply for the second time, may-be they've marked it as an unlocked somewhere in the database. Anyway I need to cross the UA/PL border twice to do it.

After baking method, my phone is on, but switching 4 small CPUs on - makes it supper laggy & unresponsive, however it does not go into bootloop mode

When are you going to post instructions?
[G4 General] xVANKO:
Relock will work also for LG G5 - this is the same security level and the same procedure ;)

Tomorrow i will post video showing this method, instruction will be on Monday or Tuesday
[G4 General] tim455:
Does that mean that there is a chance for an unofficial unlock in the near future? for those without EUR devices?
[G4 General] xVANKO:
Yes, there is a big chance to unlock non-euro devices. Probably if you flash prepared by me dumps I can transorm any LG variant to EURO variant - of course with possibility to go back to stock.

Just uploaded video to main thread.
[G4 General] kabirjedi:
Nice ! Thanks .but i wait step by step instructions video very laggy :D:D:
[G4 General] onotor:
When we can get dumps to flash ??
[G4 General] polfrank:
I think there will be a guide for us to flash our own dumps!

What I wonder is, if we have an unlocked, international h815 and take the "unlocked dumps" from it and flash them to an non-officially-unlockable LG G4 from some carrier, would the second be unlocked?
[G4 General] onotor:
I don't know too much about dumps but some developers were working at editing the unlock.bin

That "dump" which we are talking about, is it similar to LG G3's "bump" ??
[G4 General] xVANKO:
Just wait till Monday or Tuesday ;)

P.S. Lengyel, magyar – két jó barát, együtt harcol, s issza borát ;)

Monday or Tuesday ;)
[G4 General] xVANKO:
This is what im think about it - im going test it on H818 and on nonEU H815
[G4 General] OllieD:
Thank you for including me in the credits.

Glad my findings helped encourage someone to find a solution.

I noticed in the video that you restored almost all the partitions of the device,

Which ones contain the unlock status?

Do i need to dump and restore all those partitions?

Can anyone else here confirm this process works for us please :D

Had my G4 since Feb and refused to unlock until this problem was solved. looks like i might be unlocking my bootloader very soon :D

Thanks again Buddy :D
[G4 General] xVANKO:
No problem ;) The most important are MISC and CUST. First contains informations about whole bootloader lock - second contains some extra informations about bootloader state - also boot image and information about lock state while booting :)

This video was recorded 7 days ago - i restored all partitions that changed after bootloader unlock. Now i discovered that you need only to reflash CUST and MISC partitions :P

Also if you have locked bootloader you should prepare your own partitions dumps (MISC and CUST) and flash it after you want to go back to locked bootloader
[G4 General] xVANKO:
Editing unlock.bin will not work - this is HEX representation of call to more complex procedure which do some modifications in multiple partitions.
[G4 General] OllieD:
Cheers,

I need to reflash my phone due to a bluetooth bug. (Bluetooth keeps randomly turning off, probably due to some app)

I will flash back to lollipop and make backups of all my partitions.

I'll give this a shot after i unlock and let you know the results.

Might not be today as i have a lot to do.

Looking forward to your guide to help those with a lesser understanding of these things. :D

Thanks again!
[G4 General] onotor:
I got it but i have a question.

We have to own a rooted device to get partitions right ?
[G4 General] Minto107:
Not really, you need a pc and send command.exe

Wysłane z mojego LG-H815 przy użyciu Tapatalka
[G4 General] polfrank:
Guys, forgive my dumb question, but I think that the misc and cust images are included on every official kdz from LG. So, in my understanding, whenever you flash a kdz, you are reflashing these partitions from the beginning, right? This is no different than the send-command flashing method! I know I'm wrong, but as I get it, we should be returning to relocked state every time we flash a kdz, just because misc and cust are being reflashed. Can you explain to me what I am missing?
[G4 General] Minto107:
I know nothing about kdz and flashing anything on LG devices but I know that those images may just update some files on partition

Wysłane z mojego LG-H815 przy użyciu Tapatalka
[G4 General] BananowyPotwor:
I just bought new one LG G4, I want unlock bootloader. I have one question. If I unlock the bootloader and the phone will get bootlop I will be able to lock the bootloader and send it guarantees? Sorry for my bad english :)
[G4 General] onotor:
I have read some feedbacks from users who tried this before, and flashing a kdz is not affecting on Bootloader, They say..

otherwise it would be easy that locking bootloader with flashing a kdz.

---------- Post added at 04:05 PM ---------- Previous post was at 03:59 PM ----------

If you'll get caught by bootloop, you can try some temporary fixes on xda. After you fix the bootloop for a short time, you can lock your bootloader by a method like written in this thread.

then you can send your phone back to guarantee I think...

And I don't suppose that your phone may get bootloop because you bought a brand new G4 ....
[G4 General] polfrank:
Ok, I agree, but the method described in this thread does not touch the bootloader either. And the files written with the Send_command are files that also exist in kdz's! This is why this sounds weird to me...
[G4 General] onotor:
For locking bootloader, do I have to get some files (misc, cust) from locked bootloader, right ?
[G4 General] BananowyPotwor:
Thanks for answer. There is a big question. If i get bootlop and disable 2 cores, relock bootloader i have 100% sure for warranty?
[G4 General] onotor:
If you have locked bootloader you have warranty
[G4 General] ObiDanKenobi:
In order to use the warranty, you have to have the bootloop. If you disable 2 cores then you do not have a bootloop. So, after you relock the bootloader you have to enable again the big cores.
[G4 General] Levent2101:
top work, however I am not sure how people like me who doesn't have the dump of CUST and MISC partitions are supposed to do? from what I understand you basically force flashed entire partition from a dump you created before unlocking your bootloader? are those partitions generic? or am I missing something here?
[G4 General] petro_ionut:
Commands for back-up cust and misc, please!
[G4 General] xVANKO:
I need to compare dumps - maybe they're universal - can you create it ? Use Send_Command.exe

dd if=/dev/block/mmcblk0 bs=8192 skip=585216 count=32768 of=/data/media/0/cust.img

dd if=/dev/block/mmcblk0 bs=8192 skip=16384 count=2048 of=/data/media/0/misc.img

dd if=/dev/block/mmcblk0 bs=8192 skip=585216 count=32768 of=/data/media/0/cust.img

dd if=/dev/block/mmcblk0 bs=8192 skip=16384 count=2048 of=/data/media/0/misc.img
[G4 General] kingtm:
Hello. For those of us who have unlocked bootloader will be possible to lock him again?
[G4 General] xVANKO:
Yes, im going to release my own dumps - monday or tuesday ;)
[G4 General] kingtm:
Thank you very much [MENTION=7883776]xVANKO[/MENTION]!
[G4 General] petro_ionut:
Thanks, but not saved in internal memory i cannot copy them enywhere else, pc or external sd!
[G4 General] xVANKO:
When youre launching LGUP, you need to remove USB cable as soon as COM port (green text) appear on ur phone - please, try again.

You need to use Send_Command.exe
[G4 General] petro_ionut:
Sorry i wrote wrong, i have the partitions saved in internal memory media/0/, but i cannot copy them enywhere else, it wont let me!
[G4 General] ObiDanKenobi:
It is because you create them with root, so root is the owner of these files. You have to change the owner to media_rw

---------- Post added at 11:49 PM ---------- Previous post was at 11:48 PM ----------

I know this because I had the same issue with the dump of the system.img
[G4 General] onotor:
I am waiting for the possibility of unlocking non-Euro device

I hope it works
[G4 General] Tonyburn:
Not sure if its possible as I cant find the cust partition on a H812 model....... Only the misc one...... I pmd xVANCO about this issue and created dump files anyway.... So all that would be left to do would hex compare the 2 dump files from a H812 and a H815 ( from locked bootloader ones ) and see if they are the same. If so then MAYBE flashing the unlocked H815 dump files to a H812 using xVANCO method could unlock the bootloader of a h812........ If someone can send me the dump files from a locked H815 i could hex compare them with the h812 dump files I have. Pm me anyone who can help me.
[G4 General] petro_ionut:
But i don't have root, i am from Romania too, Bucharest! I can delete them but not copy or move!

I've created them with Send_Command.exe \\.\COM

I've managed to copy to external:

dd if=/dev/block/mmcblk0 bs=8192 skip=585216 count=32768 of=/storage/external_SD/cust.img

dd if=/dev/block/mmcblk0 bs=8192 skip=16384 count=2048 of=/storage/external_SD/misc.img
[G4 General] jskasia:
You will need to use this kind of command I guess:

$chown media_rw:media_rw /storage/external_SD/cust.img
$chown media_rw:media_rw /storage/external_SD/misc.img
$chmod 0777 /storage/external_SD/cust.img
$chmod 0777 /storage/external_SD/misc.img
[G4 General] ObiDanKenobi:
Normally you do not have root, but when you run send_command.exe you run under the context of the root user.

You have to run the commands listed one post above under send_command.exe to change the owner.
[G4 General] andrea1493:
Does the commands are valid for the H815 (EU variant LG G4)? :)
[G4 General] xVANKO:
Cust and Misc partitions are not included in kdz files. Probably you're talking about aboot and boot partitions.

This commands are dedicated to H815 (EU) ;)
[G4 General] petro_ionut:
Perfect it worked for internal, for external saves is no need! Thanks.
[G4 General] xVANKO:
Also there is a better version ;)

For internal:

chown -R media_rw:media_rw /data/media/0

chmod -R 0777 /data/media/0

this change owner and permission for whole directory
[G4 General] ObiDanKenobi:
Mount external sd

How did you mount external sd ? to see it in the external_sd mount point ?
[G4 General] OllieD:
Just tried this and my bootloader stays unlocked after restoring pre-unlocked cust and misc partitions dumped with your commands.

I will wait for your guide. however if you would like me to check anything send me a pm and i will take a look later.
[G4 General] petro_ionut:
After Send_Command.exe \\.\COM...

ls -la /storage/external_SD/

its all i did!
[G4 General] xVANKO:
you need to format ur sdcard to ext4 and insert it after you go do download mode

it only mount point - it wont work
[G4 General] ObiDanKenobi:
Aha, I tried over and over to mount the sd card, but I guess it is formatted fat32.

When I inserted the card in download mode, I got a red message with a mount failure. So basically you say that all I needed was to format the card ext4 and then would have worked ?
[G4 General] xVANKO:
ext4 is working in my device in download mode - without any mount failure :P
[G4 General] jskasia:
I've sent my dump of h818p to the OP, hope we will hear a good news soon. :)
[G4 General] andrea1493:
I suppose that you have to flash the tot file used for disable the big cores and after that you can relock the bootloader
[G4 General] onotor:
What about other variants?
[G4 General] xVANKO:
Probably it will work for other variants - im going to test it today
[G4 General] polfrank:
So, if we dump our cust and misc partitions we are safe for BL relock when this tool is released? I saw that these are the commands:

dd if=/dev/block/mmcblk0 bs=8192 skip=585216 count=32768 of=/data/media/0/cust.img

dd if=/dev/block/mmcblk0 bs=8192 skip=16384 count=2048 of=/data/media/0/misc.img

[MENTION=7883776]xVANKO[/MENTION], Can you share the command for persistent partition?

EDIT: Hmm, I took it from the video, I assume it is this one:

dd if=/dev/block/mmcblk0 bs=8192 skip=23808 count=256 of=/data/media/0/persistent.img

I'm thinking of dumping and unlocking today! :D
[G4 General] onotor:
Can you tell me instruction for dumping ? Which variant are you using by the way ??

---------- Post added at 04:28 PM ---------- Previous post was at 03:45 PM ----------

Is there still chance to unlock non Euro devices ???
[G4 General] polfrank:
I have just done it. I have unlocked my LG G4 H815 via the official LG way and relocked it with the method provided in this thread. Good job! :)
[G4 General] onotor:
Vanko, unlocking thing is going well right ??? :(
[G4 General] xVANKO:
Dont dump using commands from video if your phone is not H815 *EU VARIANT* - each device has diffrent dd parameters !!!

Im writing instruction.
[G4 General] OllieD:
which partitions did you restore?

i couldn't get mine to re-lock..

i restored both the cust and misc partitions with no effect.
[G4 General] LaughingCarrot:
On the edge of my seat right now.
[G4 General] xVANKO:
I've just tested SEA H818 and it works - so I found also unofficial way to unlock ALL LG G4 variants :D - Just modificate unlocked partitions via HEX EDIT :P
[G4 General] andrea1493:
I've downgraded to lollipop and, rebooted in to download mode, opened Send_command program and I've created a dump of all three partitions. Now I can see them into internal memory but with the Hex editor the seems to be completely empty (there are only zeros). Is this normal?

Edit: I've seen that more later there are other characters. I'll wait for your instructions.

Thank you very much for your job!
[G4 General] Engelm:
Wow, This is fantastic!!!!

Great News :)

Please Write instructions, take your time, we are used to wait some time to get BL unlock :P

I am so happy right now
[G4 General] xVANKO:
Dump commands used in video are dedicated for H815 *EU VARIANT* - ONLY!!!

I will include commands for other variants in tutorial.
[G4 General] andrea1493:
Yes I have EU H815 variant (Italy). But the dump starts with zeros in the Hex editor?

And the three partitions (cust, persistent and misc) are sufficient to relock the bootloader? :)
[G4 General] xVANKO:
Oh, I understand - yes this files starts with zeros ;)

And yes, this three partitions should be sufficient to relock :P
[G4 General] adamz667:
Same here, EU variant. Maybe it's HOAX?
[G4 General] xVANKO:
Guys, dont try to relock it before i release guide :P

Im just finishing it :P
[G4 General] onotor:
Good work congratulations :D
[G4 General] powerserge1:
So this means we can all flash custom ROMs now and root the phone without issues? Awesome work and for the G5, V10, etc too.

Every LG phone owner with a locked bootloader that's wants the ability to flash away and customize their phone should each donate you $1. Wont cost us much but there's a nice sum of $ for all your hard work. My funds are limited but I am in for a few $.

Hopefully someone can automate it so it can be done in a couple clicks. I would not want to do something wrong in the process and have something go wrong with my phone but that's me.
[G4 General] LaughingCarrot:
Well he's already got that $3,000 bounty for him if this is actually true.
[G4 General] powerserge1:
If true it will be and should be more. Lots of G5, v10, v20 users want to be able to customize their phones as well. The OP is not asking for $, he is giving us the info freely. For that reason alone IMO he deserves to be rewarded. I am sure he had help which is why he has credits. 3k does not go far if spread among several people. If true, let's reward the devs is all I am saying.

Like a good app that is worth paying for, if this works then same thing
[G4 General] LaughingCarrot:
Oh yeah I do believe he deserves more but I was just stating how much he'd be (somewhat) guaranteed to receive. Now what I'm interested in finding out is if his method will work for devices that have ADB disabled like all the American variants barring T-Mobile. Now since it's very late in Poland, we might have to wait until tomorrow to find out.
[G4 General] LaughingCarrot:
What's concerning to me is that after a year, the answer was to use a hex editor? Next thing you know we're gonna find out we should have set the phone to wumbo.
[G4 General] Minto107:
important info to all not H815 EUR users that are going to unlock their phones and may will to relock

I would strongly recommend you to backup your partitions before unlocking, as remember that you will flash H815 EUR partitions, and when you will like to give it back on warranty repair LG may spot that your partitions are from other phone model and may refuse to repair your phone ;)

Wysłane z mojego LG-H815 przy użyciu Tapatalka
[G4 General] onotor:
Backup commands are being different depending on Variant