yashsingh1/xdaforums huggingface dataset:
[G4 General] onotor:
Although, I can flash this kdz and use the modified aboot.bin when it will be ready? Am I right?
[G4 General] KnightOdin:
It's the idea.. but we need to wait
[G4 General] rfsaidel:
Hello!

The SD Card process doesn't work.

But i did with this tutorial: http://forums.easy-firmware.com/sho...4-H818-H818P-H818N-Brick-hs-usb-Qdloader-9008

After that, I can found my phone as QDLoader 9008 ... but my phone can`t enter in download mode. I don`t know if is related with BOOT img that i've uploaded before the brick.

do you know how can enter in download mode now? - QFIL process finished with success, but i don`t know the next steps.

Thanks!
[G4 General] Tomonok:
The same situation here. Please let me know if you figure out how to enter download mode. Thanks
[G4 General] raptorddd:
nice when will you collect tpart of the bounty.. :D:D
[G4 General] jskasia:
Dear [MENTION=7045959]pvineeth97[/MENTION] ,

Your works is interesting. I have some questions:

1. Do you sure if the aboot partition of two phones (even the same model like H818p, and OS firmware version) are exactly the same ?

If they are different. Patching it on the different phone might cause the hard brick.

2. The main reason why we need the unlocked bootloader is because of the lack of root in Marshmallow. So as you suggested to unlocked bootloader in Lollipop. What is the point of doing that ? Just to enable TWRP ? To be honest, I don't think it worth it.

3. I would suggest that if you can decompile the aboot partition and modify the secureboot checking function. People should send you the original aboot partition from Marshmallow based rom. Or you may create a tool for aboot patching.

Even the is no root in MM, we still able to issue 'dd' command using the 'cable pull' method to inject your modified partition back into the phone. However, as I mentioned, I think it is okay if you put the modified aboot where it based on you own phone, but it is risky to put the modified aboot partition of others into your own phone.

As far as I know, your method quite universal for many qcom models. However, spreading it too early when we don't completely understand how it works can cause problems for many people. And yes I know it is their own risk. Hopefully, your completed method will bring us a great contribution.

Thanks,
[G4 General] onotor:
Can you please tell about the cable pull?
[G4 General] jskasia:
Read method 2 on the thread below. On step 20 you will able to issue dd command you wanted.

https://xdaforums.com/showpost.php?p=68806377&postcount=1
[G4 General] onotor:
So, What can I execute on using the dd command? What it does??
[G4 General] Fobos531:
I have a mid-range phone from March 2015 (G4 was released in 2015 as well). The phone's name is LG Spirit LTE H440N. It shipped with Lolipop and received an update to Marshmallow. My phone is very restrictive in terms that fastboot is very limited, bootloader cannot be unlocked and I can't root the phone with Marshallow. I can root ONLY on Lolipop. There was absolutely no development for my device in 2 years. But thanks to pvineeth97, who used the method to patch Lolipop's bootloader (aboot), we now have an unlocked bootloader and the development can begin! I already ported TWRP to our device and we will hopefully get custom ROMs as well. After all, I don't see why we wouldn't, because we have specs similar to Moto E 2nd gen or Moto G 3rd gen.

Now, to answer your questions:

1. No, aboots of two different phones aren't the same. Flashing the same aboot on two different phones would certainly cause a hard brick on one of them. However, the way in which aboots are made is similar in many LG phones. Basically, if you flash a custom recovery and then try to boot into it (with locked bootloader), you will get a Secure Boot error which doesn't allow you to boot unsigned images (only images that were signed by LG can be booted). However, a lot of LG bootloaders were unlocked using the following method: if you disassemble the aboot partition, you will see that there is a specific part that checks whether the image you're booting is a one signed from LG. If it's not, the Secure Boot error will pop up and you won't be able to boot into a custom recovery. The part which checks this can be patched in order to trick the phone into thinking that we're ALWAYS booting valid images so the phone thinks that the custom recovery image was signed by LG, effectively unlocking the bootloader. The method of patching the aboot partition is similar to many LG phones and that's why it can be so widely used.

If you have two phones of the same model (H818P for example), and flash the exact same KDZ on both of them, then yes, their aboot partitions are exactly the same.

2. Marhsmallow has less security vulnerabilites than Lolipop and it will be much more likely to be able to patch the aboot from Lolipop. You also need Lolipop because of root; you need root to be able to flash the recovery image and to flash the patched bootloader (aboot). Yes, it's worth it, because then custom ROMs can be developed for this phone. You can get TWRP and make a flashable zip of stock Marshmallow if you want.

3. That's very complicated. The software used is IDA PRO Disassembler and it requires skill to be able to patch the bootloader.

Hope I made everything clear. I may have made some mistakes here and there, but the rest should be on point. :)
[G4 General] Halapeti:
Please tell me anyone tried it on H818N?

If yes please share the steps......
[G4 General] jskasia:
Thanks for answer. One more question please.

As we known some people in this thread bricked their phone by entering the wrong command and flash on the wrong place. However, OP said if the patched aboot partition and the based KDZ does not match device will be bricked.

This brought me the conclusion that the different KDZs have their own aboot required to boot up, am I right ?

What about the custom ROMs? Is it possible that some of them require its own aboot,

and flashing they through TWRP possibly cause the device brick ?

You know it hurt to recover from qcom 9008, as we need the whole dumped partitions from the identical device.
[G4 General] Fobos531:
Yes, different KDZs have their own aboot required to boot up. Every aboot is unique to its KDZ and therefore, patched aboot should be flashed only on the firmware (KDZ) which it was extracted from to prevent bricking the device.

Regarding custom ROMs:

From what I've understood, no, custom ROMs don't require their own aboot. For example, you can patch aboot on Lolipop, and then make a flashable zip of stock Marshmallow, flash it using TWRP, and it won't brick the device, because the device is still using patched Lolipop bootloader. I don't know of any custom ROMs that require their own bootloader/aboot. Once your bootloader is unlocked (patched), its unlocked and you don't touch it. However, some custom ROMs use their own kernel (the "boot" image). NOTE: The "aboot" and "boot" images are NOT the same. "aboot" is the bootloader and "boot" is the kernel used by the system. So, even if a custom ROM uses a custom kernel, there's nothing to worry about, because it cannot brick your device (at least from what I understand).
[G4 General] Engelm:
... and why would a custom rom come with a bootloader which does not allow the phone to start this custom rom. ?
[G4 General] jskasia:
Thanks for sharing :good:

:D
[G4 General] steadfasterX:
True. The only thing I want to make more clear for everyone:

Each kdz contains an aboot image. You can extract a kdz and you will see all images like laf, aboot, boot etc!

That means:

When you flash a kdz after you unlocked your device it gets "locked" again! This shouldn't actually brick anything but just want to add this here.

.
[G4 General] onotor:
What I learned:

I can not get the aboot from my MM device unless I got root. Therefore I have to flash a Lollipop kdz, root the device and get the aboot...

I am waiting for the great news..
[G4 General] steadfasterX:
Well.. To be honest one way to be bulletproof would be that we

- extract the aboot from a kdz

- patch this aboot and replace it in the kdz

- replace boot image with one containing e.g. llama and root in the kdz

- replace recovery with TWRP in the kdz

This will avoid any bricks regarding not matching kdz. Well this has to be done for EVERY single device model but the most important part is we need to patch the aboot files.

Then one needs to just flash that kdz with lgup and that's it. Long way to go but I think its worth it..

.
[G4 General] onotor:
Both of the methods are good, but the one that you told is seems like more safe.. I would like to learn how to extract files from a kdz and patching a aboot file
[G4 General] alitavas:
I think if you try to boot your rom(Android 6) with 5.1 aboot your phone will hard brick

It means that your aboot and your rom always should be the same

I think this method will work:

Downgrade to 5.1 rom

Install aboot 5.1 patched file

Install TWRP Recovery

Boot into TWRP

Flash Marshmallow Rom

Install SuperSU

Flash Marshmallow pached aboot

Reboot

Note: I don't know my guide will work or not

Don't try it!!!

The only fix for hard brick is replacing the motherboard (Don't be worry if you have warranty they will replace your mother board for free?)

Sent from my LG G4
[G4 General] pvineeth97:
Flashing Marshmallow ROM over 5.1 patched aboot is not correct. You might brick your device. Its better to repack Marshmallow KDZ/TOT with the Marshmallow's patched aboot and TWRP. Then it will work.
[G4 General] alitavas:
Thanks to you we have aboot patched Marshmallow

But what about TWRP?

There is noway to test it

Sent from my LG G4
[G4 General] pvineeth97:
TWRP? So no one built a TWRP for this device?
[G4 General] alitavas:
In the previous topic, there was a Developer for TWRP but we can't test it

Sent from my LG G4
[G4 General] pvineeth97:
Why not?
[G4 General] onotor:
OP, what's your advice to me for apply? I am getting excited..(my variant is H815 SEA)
[G4 General] pvineeth97:
Are specs same H815/H818? Can you flash firmware of H818 on H815?
[G4 General] alitavas:
Any wrong install or wrong file or wrong code will hard brick phone

Sent from my LG G4
[G4 General] onotor:
I guess, no.. How can I patch an aboot file?
[G4 General] pvineeth97:
Do you know assembly?
[G4 General] onotor:
You mean the programming languege, no..
[G4 General] steadfasterX:
Actually we have twrp for the g4 but there are different types of the g4 like h811,h815,h818 and so on.

Some of them have an official way to unlock but not all . I'm the maintainer of twrp for those official unlock able models and it will be easy to adjust or add the new models like h818.

Regarding this I wrote this in the previous topic:

Please paste the pastebin URLs in the official twrp thread! Not here.

Twrp thread:

https://xdaforums.com/showthread.php?t=3442424
[G4 General] kessaras:
Hmm. In h815 we do the same thing right? It's just coming officially from LG.

SteadfasterX is right.

But I don't understand one thing.

Why can't you update the bootloader?

We do the same in h811 and h815.

We extract kdz and flash the modem and bootloader only. So after we update the bootloader, it remains unlocked. And also it doesn't brick the device.

I think the patched aboot isn't the same with the bootloader. Aboot is the secondary bootloader and it's a different .bin file in the kdz. So after unlocking , you can still update the bootloader.
[G4 General] medo18:
I have extracted KDZ, I will try to add Aboot and merge the KDZ file, then I will inform you ;).
[G4 General] kessaras:
Yeah. 1st try see if it will boot with the unlocked aboot.

Then try do what stead said. Try add recovery bin with twrp.

Edit: doesn't matter. Can be flashed later if it can boot
[G4 General] onotor:
Can you tell me which kdz is that? for which variant
[G4 General] kessaras:
Probably he thought to use the kdz in the op. Otherwise the aboot in the op will not work.

He thought to flash kdz with already unlocked bootloader. Later if bootloader is unlocked and of course he can boot, he will reboot to bootloader, flash twrp and then su.
[G4 General] steadfasterX:
Correct. Aboot is Androids bootloader. Before that the so called bootROM and SBL starts which then starts the aboot.

Check this for a better understanding:

http://newandroidbook.com/Articles/aboot.html

So actually updating "the" bootloader of the device means flashing images to several partitions not one only. Well and yes it could... it could brick the device when you have a patched aboot and then update the bootloader. Means afterwards it could reject loading the patched aboot one day for example.

Tbh there are very very rare reasons for the need of updating the bootloader. If you know one lemme know. The main reason for bootloader updates are if a bug was fixed. That bug is normally a security hole which for example allows a patched aboot to load ;)

.
[G4 General] jskasia:
Wow, how will you guys repack the KDZ?

There are some guides on the internet, but for the previous version KDZ not for g4.

Can't wait to see.
[G4 General] medo18:
I will try today to repack KDZ of LG G4 otherwise, we can't.
[G4 General] onotor:
Which exact kdz? For h818, h815?
[G4 General] Minto107:
Why do you keep asking for H815 if thread is about H818? OP most likely has 818 so he works on this variant. If everything will work there's a high chance that H815 will receive this later ;)
[G4 General] medo18:
For H818P.
[G4 General] onotor:
Sorry for overrate, I've been looking for unlock for a long time
[G4 General] kessaras:
Did you send to LG and ask for unlock?

Or this is not possible any more?

H815 is unlocked officially. LG sends at your email the patched aboot
[G4 General] onotor:
I have the SEA variant it's not unlockable
[G4 General] AsHalt:
It's unlocked only for EUR and selected versions, the rest like SEA is a graveyard of bootloader unlock requests
[G4 General] medo18:
Until now I can't repacking the KDZ file.
[G4 General] xarekusu:
so if I understand correctly if we can repackage the KDZ we can we unlock bootloader on marshmallow?

If not we have to downgrade lollipop root and flash patched aboot?
[G4 General] Engelm:
It coes, this is it works with repacked KDZ.

Yes, this is the plan BUT the aboot has to be patched, ETA is in the future and I would wait

until some people confirmed that it is easy to unlock the bootloader or that everything works fine without any problems.
[G4 General] steadfasterX:
I use kdztools for this:

https://github.com/steadfasterX/kdztools

Which tool do you use?
[G4 General] sahalento:
It's very dangerous! I had a hard-brick too yesterday. Just no logo, no recovery, no download mode, no LED, no anything. Only short vibro when power holding or trying to hard-reset and battery frame with "?" inside when battery unplugged and plugged to charger.

Android 5.1 rooted (H818P CIS 10d), no any mods, aboot taken from my phone via adb wih PC by instruction posted here, partition mmcblk0p8, command to make backup was "dd if=/dev/block/mmcblk0p8 of=/sdcard/aboot.bin", to write into phone "dd if=/sdcard/aboot.bin of=/dev/block/mmcblk0p8". Normal mode when plugged to PC, not in download mode. All like in instruction. Aboot.bin size is 2048 KB (if u take aboot from unpacked KDZ (via WindowsLGFirmwareExtract for example) the file size is 1024 KB). My aboot for patch was 2048 KB.

So, the file aboot taken from my phone, patched and writen to phone again. NOT WORK. HARD brick!!!

Resume - authorized service center and replacing motherboard. Don't try again!!!

---------- Post added at 06:45 PM ---------- Previous post was at 06:30 PM ----------

And some questions.

-> Requirements:

LG G4 LGH818P - done

Rooted Phone - done

-> Steps:

(1) Downgrade to this Marshmallow version of Android. Download here. - MM or LP? (MM on the link), if MM see below

(2) Root your device (Using your usual root method). - H818P + MM have no root, only LP

It's impossible to make step 1 and step 2 together.
[G4 General] Engelm:
He wrote that he is working on a LP Version.

Don't do any Tutorial if you can't exactly follow its steps.
[G4 General] KnightOdin:
Maybe it's useful for all users that want try this..

To READ the NOTE at the first post.. where the developer says that someone sent to him an aboot from MM but he didn't know that MM doesn't have root yet and he patched it. NOW he is patching an aboot from LP.. and we need to have patience and wait for his work... Specially to avoid any brick.

I hope you will have your phone OK from support.

It's interesting that the aboot backup from the command Window have different size.from the extracted from.kdz
[G4 General] vbnm2003:
He dont know himself.
[G4 General] derSA7:
the OP dosent have an lg g4 ,he unlocked the bl for the k10 and other mid to low-end phones ,and he is expecting it to work for other 2015 phones ,we got a patch from him for the flex 2 but no one tried it yet we just need to confirm if this method is working :(((((
[G4 General] sahalento:
Yes, he wrote. And read my post one more. I wrote that I have LP and root.

And OP doesn't patch aboot himself, he sends aboot to another user who do it. I got my patched aboot from this end-developer. Just he doesn't know english therefore he doesn't post here in one's own name.

So pls don't tell me how to follow any steps. If U know more - write here.

P.S. Initial post (https://xdaforums.com/g4/development/unofficial-bootloader-unlock-lg-g4-t3563898):

-> Steps:

(1) Downgrade to Lollipop version of the Android. Download here.

(2) Root your device.

(3) Download the patched aboot file. Click Here.

(4) Connect your phone to the computer. In command prompt, type "adb shell".

(5) Transfer the aboot file into /sdcard/ folder.

(6) Type "su" to enter the root shell. Then type "dd if=/sdcard/aboot_237568.bin of=/dev/block/<your aboot partition>".

(7) Restart your phone by typing "reboot".

Now OP writes to downgrade to MM. Downgrade from what? That's why I asked the question above.

Different sizes of aboot from phone and from KDZ - whole partition size (2048) and file size (1024)
[G4 General] Engelm:
Downgrade (because most of us would be on a higher Android Version) or upgrade tothis specific KDZ... it has to be the correct one for this unlock.

Maybe this is why the aboot partitions have different sizes.

And of course, I understood it correctly. You have a rooted LP installed. But you haven't installed the KDZ he has linked.

After that you would have found out that it is not possible to root MM and hopefully cancelled the rest of the steps.

I don't want to tell you how to do things or not but you broke your phone, right?
[G4 General] sahalento:
We can't (H818P users) to have MM and root at the same time. Only LP + root or MM + no root. And MM users cannot to make some steps from instruction like "su", "dd", backup and writing patched aboot. Because there in no root. Only on LP.

I got my patched aboot directly from the developer, with his instruction. And this in not work now. He knows about this. My post about this - at this time OP's method is incorrected, I didn't see any successful reports from users, only reports about hard-brick. So I want to warn others. Let the OP solves the problem. But at this moment it is dangerous.

Yes, I had hard-brick after typing "reboot". But now it's OK. Just new motherboard.
[G4 General] medo18:
Yes, we have to downgrade lollipop to flash Aboot.bin.
[G4 General] cerg2010cerg2010:
Do not flash this or your device will be bricked! Aboot is signed!
[G4 General] El Presidente81:
OP, is this the case here? Have you tested this on your device or have you just posted the method for another phone and presumed it would work for the G4?
[G4 General] pvineeth97:
[MENTION=5305255]cerg2010cerg2010[/MENTION] helped me patch the aboot. We both are involved.

Look buddy maybe Marshmallow's aboot is signed. I am investigating about Lollipop's aboot. If it is signed too no way to go.
[G4 General] pvineeth97:
Its not that I tried with lower end models and I am coming up with this method for G4. Even K10's aboot is signed. We patched against secure boot. It worked.
[G4 General] El Presidente81:
So you've not tested it yourself and presumed that because it works on lower end models, it will work for the G4?

Can you answer a simple yes or no to that question please.

I'm not trying to be difficult, but there have been at least 2 bricks in this thread thanks to this method and it would've been good if you'd added that you've not done it yourself to the OP.
[G4 General] pvineeth97:
I don't have a LG G4. I got 1000's of requests to get aboot's patched when we patched aboot of K10 and unlocked the bootloader. It is responsibility of the guy who requested to test it.
[G4 General] pvineeth97:
You know why people got bricks? They did'nt read the guide properly. They flash it over other ROMS. Not my mistake.
[G4 General] El Presidente81:
So you, nor anyone you've worked with for this method has actually tested it on their own devices before releasing the guide?

Why wasn't that mentioned in the OP? What you've written makes it sound like the guide actually works but in reality, you're looking for people to test if it does. You have the standard disclaimer about users responsibility etc, but nowhere does it mention that you're unsure whether or not the method works for the G4.

---------- Post added at 10:40 PM ---------- Previous post was at 10:38 PM ----------

What if the guide is wrong? You've linked to a marshmallow kdz and told them to root via the normal method.

Marshmallow can't be rooted.
[G4 General] pvineeth97:
Look. I got to know that Marshmallow cannot be rooted later when I talked to the guy who requested who sent me the aboot. Or else. This guide is perfect.
[G4 General] kessaras:
don't answer them. its their own device and they do whatever they want with it.

if they are too nub , they see that the guide is wrong cause MM can't be rooted and they still flash the patched signed or not aboot....... thats their own problem and they have to think about their own intelligence and IQ meter.

Would you flash TWRP if it wasn't flashable or if the OP said that he is working for another version ?

Would you flash a rom by force using fastboot if the rom had error in twrp ?

Yes the guide has a mistake, but people still flash it, it's their own problem. Anyone who did, tomorrow morning go see a doctor and stop flooding XDA with crap.
[G4 General] derSA7:
a guy on the lg g flex 2 topic flashed it with the same software ver and module and still got a brick

i don't think its worth it to waste a 150$ phone on this

---------- Post added at 09:36 PM ---------- Previous post was at 09:34 PM ----------

hope the OP will delete this topics before more phones brick
[G4 General] medo18:
I know that I mean we have to downgrade to LL to flash Aboot for LL not MM.

We are still waiting the OP to make it.
[G4 General] pvineeth97:
Even if Lollipop's aboot will be signed we can't do anything.
[G4 General] pvineeth97:
Also look at LG Spirit. Patched aboot works there.
[G4 General] pvineeth97:
People don't understand that there are lot of risks involved in unlocking the bootloader unofficially. I had to face the same situation when I flashed my own TWRP which I created for my device bricked my phone completely. I went to the service center and got it replaced. The guide just assumes that you know what you are doing. Patching aboot is a not a fool proof method always for every phone to get bootloader unlocked. While few phones like K10, LG Spirit (released recently) responded positively with the patched aboot and for some phones it may not work. I can't deny that people are blind sometimes when I even clearly mention on which firmware to flash the patched aboot, they flash it has they will. I can't help them in anyway.