[T-Mobile LG G6 Guides, News, & Discussion] sfernandez:
Don't know if this can help. Found in LG G4 General

About

UsU = Unofficial secureboot-off/steadfasterX Unlock

This will "unlock" your bootloader and so enables you to install TWRP and custom ROMS as you like.

To be honest unlock is not the correct wording but I will still refer to it as unlock as the result is the same:

UsU will disable "Secure Boot" which verifies signatures on several partitions like: boot and recovery. Disabling secureboot means it will still verify and give you a secure boot error on boot BUT it will ignore and just boot afterwards (similar to a regular unlock).

This is the outcome of a

loooooooong

finding process. long? I started with the first attempt in this

over 1 year ago

. yes.. (think about my nickname heh?!)

A lot of stuff happend since then which all together helped me to accomplish UsU at the very end (yes all these links are my work including some brave testers ofc! ;) ).

You wanna know how this big

puzzle

fits together?

UsU is not just an

unlock

! Its a combination of massive changes in TWRP, the G4 kernel and providing all the tools around like FWUL or SALT!

It was really my

biggest

project in android development and its not just providing the actual unlock files ;)

Hijacking the boot process via EFIdroid, TWRP in FIsH and FIsH in general

AntiRollback and firehose(!) findings

Partition tables for any G4

FWUL because I needed a valid base for all my testers (one of the reasons why I started FWUL)

The LG-Up replacement and now unlocking tool SALT !

Without

SALT this all would be absolutely crazy risky and absolutely

nothing

for the average user!

many many unlock methods/theories (and millions of times soft and hard bricked) in my PoC thread

while unbricking I found a way to unbrick even when QFIl fails with my sdcard unbrick method

hard-hard bricked (no other recovery then by LG / chip replacement)

for 4 times

.. (thanks ILAPO!)

many TWRP tests and changes to detect UsU devices properly

HINT:

OPEN THIS THREAD IN A BROWSER!

NOT IN AN APP!

THATS THE ONLY WAY TO FULLY SEE EVERYTHING AS IT SHOULD BE

REQUIREMENTS

UsU does

not

care about a country version of a model (e.g. H815 TWN and H815 TUR are all referring to as H815).

So you will find only the main part of your model listed which means it will work for any of them!

1) Your device should be one of these (SALT will detect your device and only allows to flash for these variants):

LS991

F500

H810

H811 (wth? yes that works but.. you can unlock OFFICIALLY! its just a fastboot command!)

H812

H815 - any non EUR

H815 EUR (wth? yes that works but.. you can unlock OFFICIALLY! its just a login on the LG website)

temporary

disabled

: H818 (KNOWN ISSUE: TOUCH STOPS WORKING! I'm still working on a fix ...)

H819

US991

VS986

Note: SALT will tell you which ROM type is compatible with your device within the main screen: GPT compatibility

Yes there is a way to flash also H815 ROMs on those who do not support it out-of-the-box but this is very risky and requires either a change of the partition table or the ROM build developer need to change the fstab (riskless for you)

2) ARB less or equal

2

-

UNTIL FURTHER NOTICE THIS IS THE MAX ALLOWED ARB!!

can be recovered easily with a Box or sdcard unbrick or the very very risky(!) QFIL method if something goes wrong

...but YES: You can still flash UsU on ARB > 2 but if you have a higher ARB then 2 recovery can be much harder (if ever needed..)

--> Just use SALT to identify your current ARB and read here how to identify and verify: G4 AntiRollback

* Reason:

UsU is based on an ARB 2 based aboot (part of the bootloader stack) and so ARB > 2 will brick

The recovery firehose (QFIL programmer) we have is only working up to and including ARB 2. So everything beyond may can not be recovered anymore.

There is still a good chance though as my sdcard unbrick method will even recover devices with an ARB > 2 but it may not work for everyone and it requires that your device is in 9008 QDL mode.

3) Your device firmware must be LP or MM (while MM is recommended to avoid issues)

LIMITATIONS / KNOWN ISSUES

1) Do not flash any KDZ / TOTs or any ROM containing a bootloader stack (like v29a pure does) ! You WILL loose unlock and may hard-hard-brick your device (at least HARD BRICK)!

2) Do not flash any KDZ / TOTs or any ROM containing a bootloader stack (like v29a pure does) ! You WILL loose unlock and may hard-hard-brick your device (at least HARD BRICK)!

3) Do not flash any MM or N bootloader stack containing the file named: aboot. This will immediately lock your device and so definitively HARD BRICK!

4) If you want to flash a MM or N modem partition (aka firmware) you need to

re-flash

<model>_UsU_basebands_flash-in-twrp.zip otherwise you will bootloop, stuck on boot or see a blue screen with a modem crash (this may change if I ever get my kernel module working...)

5) If a ROM has no active developer or the developer has not made it UsU compatible you may need to open the ROM zip file on your PC and change the update-script within (just remove the assert line at the top is enough)

6) The fastboot mode coming with UsU will enable fastboot

flash

but the command fastboot

boot

will not work (like on the semi-official N bootloader stack)

7) Most important: Once you go this way - there is no way back!

SERIOUSLY

. The only way to make the device exactly like before is replacing the mainboard. If you're scared:

good

.

Think twice and don't complain later if you go on!

8) Do not flash any KDZ / TOTs or any ROM containing a bootloader stack (like v29a pure does) ! You WILL loose unlock and may hard-hard-brick your device (at least HARD BRICK)!

YES I REPEATED MYSELF 3 (THREE) TIMES (... for a reason)!

#include <std_disclaimer.h>
/*
* Your warranty is now (maybe) void (well not really but just for the case...)
*
* I'am not responsible for bricked devices, dead SD cards,
* thermonuclear war, or you getting fired because the alarm app failed. Please
* do some research if you have any concerns about this howto/unlock method
* before using it! ---> YOU <--- are choosing to make these modifications, and if
* you point the finger at me for messing up your device, I will laugh at you.
*
*/

Downloads

YES. ALL of them:

Latest unlock package by steadfasterX (only download for your device model required) --> <model>_UsU_unlock.zip

Latest baseband package (only download for your device model required) --> <model>_UsU_baseband_flash-in-twrp.zip

Latest TWRP (PREVIEW-103 or higher!) by steadfasterX --> http://droid.binbash.it:8008/TWRP/N

A custom ROM of your choice (see Requirements topic to find a compatible one!) --> e.g. all newer builds here: http://droid.binbash.it:8008/

Linux: I highly recommend to use FWUL - an android lovers live ISO which can be booted from an USB stick which has everything needed on board!

Latest FWUL *persistent* by steadfasterX (HAVE TO be

version 2.6

or later!): https://bit.do/FWULatXDA

even when FWUL forgetful will work fine, too: the persistent one will save your settings and so is always the best choice !

only if NOT using FWUL:

Latest SALT version (minimum version:

v3.9

!) by steadfasterX: SALT

Important note about bootloader/modem stuff!

You will find on several ROM threads the hint that you must have a specific bootloader stack in order to make the ROM working properly.

What in reality is

needed

on these ROMs is just the MODEM (aka firmware) partition nothing else. Believe me I know this

for sure

;)

If you later want to install custom ROMs based on

N or O

(

any

model! and

any

ARB) --> N modem

1) Flash G4_29a_N_modem_UsU.zip in TWRP

2) Flash your baseband package (<model>_UsU_baseband_flash-in-twrp.zip) in TWRP again!! If you don't you will get bootloops, android hanging on boot or modem SoC crashes (blue demigod screen)

COMPLETELY OPTIONAL!!!! AND ONLY: If your device is a h815 one ARB = 0 you COULD flash the complete bootloader stack though (if you wish - but as said it is NOT needed):

UsU bootloader stack for N / O

Optional (only when you encounter issues which requires debugging):

The aoscp DEBUG only build which ensures kernel will not crash on modem issue and ADB is enabled without auth

aoscp_UsU_4.1.2-20171222_DEBUG.zip

Flash UsU with SALT

(requires SALT v3.9 / FWUL v2.6 or higher)

Before proceeding ensure that you have read and

understood

the "Limitations" topic and the "Changes in behavior" topic in this thread!

UsU can be flashed in

3 different ways

! Every way will unlock your device the only difference is where you place the UsU files. Choose the one which fits best for you:

by an external sdcard (must be VFAT formatted)

by using your internal storage

by direct flashing (only when available - SALT will show this option only when possible for your device)

OK enough about all this: LETS UNLEASH YOUR DEVICE!

Extract G4_UsU.zip and copy the aboot_UsU.img, laf_UsU.img and rawres_UsU.img to either:

a) your external SDcard (directly on the external sdcard -

not

in any folder!). The sdcard must be formatted as

VFAT

.

or

b) connect your running Android device with your PC, select

MTP

mode in Android and copy it to the:

- "Internal Storage" and folder "

Download

" (exactly there!)

Start SALT

If you have not done already: DO A BACKUP

NOW

I'm serious this is your last chance to grab the important files and it just takes some minutes (in basic mode) but you have all in place if needed!

If you skip this step no one may can help you later!

Notice and WRITE DOWN the "GPT compatibility" info! DO NOT PROCEED IF IT STATES "unknown"

This part will become crucial important when it comes to which ROM you can flash!

The only valid information about that can be found in SALT!

If you see a "

H811

" there you have to flash H811 ROMs later

If you see a "

H815

" there you have to flash H815 ROMs later

If you see a "

unknown

" there you have to STOP and provide the SALT debug log (advanced menu)

Open the Advanced Menu

Click the "Unlock G4 (UsU)" button and read carefully the popup. Click Unlock, choose your unlock way and follow the instructions

If the UsU flashing fails for any reason (SALT will do important pre-checks and validiations before actually flashing):

If you see a popup about UsU flashing has

partially

failed do not be scared - just read and follow the instructions!

If you see a

different

error: do not reboot or power off the device! Ask for support and provide the debug log in SALT (in Advanced Menu -> Debug Logfile button -> Upload button and share the link)!

If the UsU flashing was successful continue:

Boot your device into fastboot mode (yes UsU has enabled an unlocked fastboot access!):

take out the battery

unplug the usb cable from the PC (not from the device)

Insert the battery again

wait 2 sec

press volume DOWN and while

keeping

it pressed: plug the USB cable to the device

keep volume DOWN pressed until you see the fastboot screen

Flash TWRP (yes you can do that now... because of UsU!):

fastboot flash recovery <twrp.img> (replace <twrp.img> with the real filename)

Boot TWRP (you will notice a secure boot error but TWRP will load!):

disconnect USB cable

take out battery

put battery back in

press volume down AND the power button and

keep both pressed

until.. you see TWRP!

Gotcha! Try that with a

locked

phone and you will

fail

! ;)

Flash the baseband package now: <model>_UsU_baseband_flash-in-twrp.zip

While still in TWRP choose REBOOT menu and reboot to

RECOVERY

(yes again!)

Notice: TWRP will show your REAL device model when connected to the PC now.

If not: SHARE THE

recovery

LOG (how-to for grabbing the recovery log is written in FAQ #4A)!

I would say: its a good time to create a TWRP backup isn't it (ensure you also select "Bootloader" in TWRP backup)?

I HIGHLY RECOMMEND to do nothing else now. Just boot into your ROM as it is! Check if everything is working and proceed only if it boots fine and works fine!

Optional

: just root now. Use Magisk or SuperSU to root your current installed stock ROM to see that it works ;)

Done. Do not miss to read the Changes in behavior topic!

Whats next? Lol you are FREE! Flash SuperSu, Magisk or a custom ROM. Up to you. Flashing issues? Read the LIMITATIONS/KNOWN ISSUES topic (especially #1, #2, #3).

Changes in behavior

Booting to recovery, custom ROM booting (or stock but rooted), booting into download mode

You will notice a secure boot error ... but it will load!

... and NO: THIS MESSAGE CAN

NOT

BE REMOVED! If you can't live with that do not unlock :P

Fastboot

After you unlocked your device with this method you will also have an unlocked fastboot mode which can be accessed by a key combo:

take out the battery

unplug the usb cable from the PC (not from the device)

Insert the battery again

wait 2 sec

press volume DOWN and while

keeping

it pressed: plug the USB cable to the device

keep volume DOWN pressed until you see the fastboot screen

Now what? You can flash whatever you want here with: fastboot

flash

<partition> <filename>

you can

NOT

: fastboot

boot

.. as this is blocked like in the semi-official N bootloader stack.

TWRP/Recovery hardware key combo

Flashing UsU changes the way the regular factory reset screen key combo is working.

After flashing UsU we can boot directly into TWRP!

power off device

unplug the usb cable from the device (if any)

press volume DOWN + power button and KEEP THEM BOTH pressed the WHOLE TIME until you see "Recovery loading" or TWRP

Factory reset hardware key combo

As written above the regular key combo to get into the LG factory reset screen changes a bit:

power off device

disconnect any usb cable from the device

press volume UP + power button and KEEP THEM BOTH pressed until you see the LG logo the first time! THEN you have to

immediately

release

the power button (

ONLY

that) and press and keep holding the power button directly again! Keep them pressed until you see the white LG factory reset screen

Proofs

Keep in mind: UsU will work for

ANY

LG G4 model and does not care about country specific ones, too! When I say:

ANY

, I

MEAN

any!

The only device which is a real special one because of different hardware (2 SIM slots) is the

H818

which

can

be unlocked but has issues (see above)

unconfirmed

(read the above!):

F500 --> I need

you

- write me a PM with the model name as subject plus a link to your SALT debug log (while phone is connected)!

H819 --> I need

you

- write me a PM with the model name as subject plus a link to your SALT debug log (while phone is connected)!

US991 --> I need

you

- write me a PM with the model name as subject plus a link to your SALT debug log (while phone is connected)!

confirmed:

H810 (confirmed) --> https://xdaforums.com/showpost.php?p=75126190&postcount=298 and https://xdaforums.com/showpost.php?p=75736723&postcount=456

H812 (confirmed) --> https://xdaforums.com/showpost.php?p=75126190&postcount=298

H815 (confirmed) --> My own one! and https://xdaforums.com/showpost.php?p=75086602&postcount=276 and https://xdaforums.com/showpost.php?p=75737617&postcount=458

H818 (confirmed)* --> https://xdaforums.com/showpost.php?p=75133410&postcount=307 * SEE ABOVE REGARDING THE CURRENT ISSUES

LS991 (confirmed) --> mine and 2 others (no link available - IRC only)

VS986 (confirmed) --> https://xdaforums.com/showpost.php?p=75109841&postcount=293

Support / IRC Channel

IRC means Internet Relay Chat and you will get

best

support there only!

Choose how to get in:

with your Browser (just a click away) (Freenode Webchat (recommended), KiwiIRC Webchat)

PC software (HexChat and Pidgin are only 2 of them! This list is not complete!)

Android app (Yaaic, AndChat, HoloIRC, AndroIRC are only a few of them! This list is not complete!)

When you have to choose a channel it is: #Carbonfusion-user

When you be asked for a server network choose: freenode

Credits

Mohd Saqib for the ls991 userdebug bootloader (http://www.gsmmarhaba.com/threads/lg-g4-h811-boot-repair-done-with-qfil.3432/) stack. Without him.. no "unlock"

LG for making a faulty mainboard which allowed me to replace it without an issue several times after hard-hard bricking

Me - steadfasterX bc I have done all this almost alone (besides the brave testers ofc) AND: just for FUN ! (I *CAN* UNLOCK OFFICIALLY!) and as the the whole guide and method is the result of many many days ... lol noooo *MONTHS* (!!!) of spending my free time on this topic!

neutrondev (details about technical understanding + support)

the_naxhoo (unlock tester), SePhIrOtX (unlock tester), Chebhou (unlock tester), fawadshah33 (unlock tester), DoughMucker (unlock tester), shane87 (unlock tester), Guy Noir (unlock tester), networkkid (unlock tester), ling751am (unlock tester), jmfecon (unlock tester), r3pwn (unlock tester)

XDA:DevDB Information

Unofficial secureboot-off/steadfasterX Unlock, Tool/Utility for the LG G4

Contributors

steadfasterX, uio88 (donator), jasonlindholm (recurring donator!), pablo103 (donator), CHAN KA LOK (donator), ReeS86 (donator), ling751am (donator), 01189998819991197253 (donator)

Version Information

Status: Stable

Stable Release Date: 2018-03-08

Created 2018-03-08

Last Updated 2018-03-16