yashsingh1/xdaforums huggingface dataset:
[G4 General] steadfasterX:
Yes try it. I've already done it but it doesn't hurt ;) . It's just until now I was alone on that stuff and so I do not described every single method I tried but it will hard brick to 9008. Sure you can revive it without problems. Just do not make the same mistake then me and flash a complete invalid bootloader chain.

Flashing aboot is not enough fe. But it will just hard brick. TZ, rpm and sdi belongs together so can't leave out one. I'm not sure about pmic though but anyway they are all signed ofc.

I'm also able to extract the root certificate chain of any of those files and while they all use the same root CA and intermediate CA the issuing CA is different so if you replace a partition which void this you're lost.

Interesting is that if you flash the new Stock N bootloader stack of a f500 on a h815 or on a h811 it works! I mean wtf? They using the same issuing CA it seems but I haven't checked it yet.. Too much workload atm but as FWUL is released now I may get more time hopefully :rolleyes:

So it is possible to flash another boot stack but it has to be valid by the certificate chain (as the stock N seems) or flashed by qfil. Imho.

sfX
[G4 General] dianxxyyzz:
Thanks for pointing out the Android N one works . Over all , it is normal to work .

About a year ago ,I was thinking to transform my H815 into a H811 ,by cloning all his partitions to see how it works ,and of course if it will be unlocked , but I was very bussy and I left out this process .

Also I think that maybe the H815 ROM who starts the booting process may be different from the H811 one so I was not sure if it will work .

But over all it looks like all G4's have harware that is starting the boot process identical .And this may be same for G5 and G6 . The ideea is , the hardware that is starting the boot process on a H815 , is identical or almost same like on all LG's G4 . All lg's just want to make sure the boot chain is signed by LG . It may also work to flash a boot chain from lg G6 into a H815.
[G4 General] steadfasterX:
yes the hardware and the boot process is identical to all G4 models.

thats not the complete truth imho. a valid signature is valid only when the whole certificate chain is valid.

tmo has its own issuing CA (H811)

LG has its own issuing CA (F500 and H815 international)

and so on

The thing is: I'm not sure what the PBL is verifying. I mean: pbl loads sbl1, sbl1 load aboot and so on

so when pbl says sbl1 is invalid it will brick. the main question i always had is how does the pbl verify? The problem is that the sbl1 of the different models all have different issuing CA's.

As long as pbl knows those its all ok but if not it will brick.

So my theory was that the pbl (part of readonly flash) is different for each device model as it may contain different valid root CAs.

If the PBL know all CA's it would work

I flashed a complete H811 KDZ long time ago and it hard bricks. The thing is here that LGup is not a good choice here ofc so I flashed all qfil related partitions of a H811 manually. it hard bricks as well.

That's why I come to the conclusion that qfil can do that hopefully in a somehow better/other way..

I flashed the bootloader stack of a H811 with qfil with the user SePhIrOtX but I'm not sure if he has blown fuses or not. the result was hard brick at least.

sfX
[G4 General] dianxxyyzz:
Yes PBL may be different from models ,is same hardware but maybe different data inside it ,is ROM .

Any way I just flased a full H811 kzd inside my LG H815 , and of course it bricked in 9008 mode .

I tried to recover it with qfill with this files .

- H815 (H815_ForFusingDevice) the one I allways used to unbrick it ,and this time did not worked , so I think the H811 kzd modified a partition that is not repaired by H815_ForFusingDevice .

-LS991 (LS991_ARB_02_RecoveryImage.zip) it worked this time phone display LG Logo try to boot but just reboots , I see led becoming blue , so boot image is started . At LG logo it say :

Secure Booting Error , Error code 1006 . Initially was just saying "Bootloader Unlocked" .

The ideea is that itwas still in 9008 mode even if I used in qfill the files fr H815 , but using the files for LS991 , worked .

Now my phone has the boot chain from LS991 , and system and boot partition from H811 , but like I said after lg logo ,led become blue and reboots . But it works .

I'm still trying to make it a H811 , I do not know if LS991 can be bootloader unlocked .
[G4 General] steadfasterX:
it would be so much easier if you come into IRC.. you re-invent the wheel.. :p

This all is done already and I know that all .. you now have a LS991 and there is no way back. you've blown fuse 100% and the only qfiles you can use from now on are the one for the LS991.

The good is you have an unlocked device now (depending on what qfil files you used though) and for this really head over to IRC. The OP has a weblink so u dont need to install anything if you dont like to..

sfX
[G4 General] dianxxyyzz:
Yes you right , it was a LS991 . And it is unlocked because I managed to install your twrp and it also boots into recovery (TWRP) . After I make it a LS991 I managed to convert it to H811 to , but it show in LGUP as a H811 bot does not boot anything .What I try is to install back MaruOs , but I do not know if the system and boot partitions have the same size like before ,now is again LS991 . I have to try and see .
[G4 General] steadfasterX:
dude really..

go to IRC. i have to repeat myself but you re-invent the wheel.

and I strongly believe that it is still a LS991. You cant convert it back. OK you can trick LGup and such by flashing H811 laf image file and you can install a H811 ROM (I have already done all this as said) but it is stilll a LS991 bc u cant change the bootloader chain anymore

well or just go on and do the same as already done before.. do the same mistakes and trials..

your choice :p

..

sfX
[G4 General] dianxxyyzz:
Yes , I will come to irc , Thank you for support ! .What is strange is that first time when I qfill the LS991 bootloader , I still had the LG Logo , after that , I Qfill another directory "LG H811 fix" ,with ppls say is LS991 too , BUT now I do not have LG LOGO at startup looool :)
[G4 General] steadfasterX:
sure the LG logo (the first one u refering to) is handled by aboot so if u have a different aboot it may be not there/displayed
[G4 General] steadfasterX:
Just for those interested i uploaded the certificate chains of some devices ( I may upload more soon ):

https://xdaforums.com/showpost.php?p=73206763&postcount=3

sfX
[G4 General] sdembiske:
Excellent find, ReeS86.

In particular, the 10/02/2016 Unlocking the Motorola Bootloader bit at http://bits-please.blogspot.ca/2016/02/unlocking-motorola-bootloader.html?m=1 could perhaps provide an exciting approach to unlocking the LG G4 bootloader.
[G4 General] steadfasterX:
well yes..

the thing is even this is well known. don't get me wrong its fully ok and i'm happy for any input (dont stop that ;) ) but i crawling through all this some time ago. used IDA pro and such to find and understand.

unfortunately i found no way to break this - mainly bc my assembler knowledge is.. well like a baby is able to sing a Symphonie of Mozart :eek:

so this way I go here is complete another story.

it will replace parts of the bootloader with leaked ones which have secure booting disabled -> this means u have in fact an unlocked devices while it's not really unlocked (but what counts is: u can flash and boot what you want).

sfX
[G4 General] steadfasterX:
Could u please provide the exact firmware version together with your anti rollback?

would be greatly appreciated!

sfX
[G4 General] alitavas:
H818P

5.1.1

V10e AME

Satan Rom(based on stock rom)

Anti-rollback is v0
[G4 General] steadfasterX:
many thx

I added it to my brand new list of known antirollback versions here:

https://xdaforums.com/showpost.php?p=73206763&postcount=3

It will become relevant for the unlocking files later..

sfX

EDIT:

This also means that converting back to the device you came from is possible but only when it has antirollback v1 or higher KDZ files.

Crazy right? that means H815 international cannot be converted back as here there is no antirollback implemented.

sfX
[G4 General] mercury54:
H812 Virgin (Bell) & Fido (Rogers):

SW version info H81220x

FW version 6.0

Anti-rollback version 0
[G4 General] CygnusBlack:
V20B (Brazil), 6.0

815P

Anti-rollback 0
[G4 General] dianxxyyzz:
Any one knows a way to restore baseband and imei?

Where exactly imei and baseband lives ?

Does imei lives inside /modem partition ?I see this is often reflashed when updating the roms .
[G4 General] steadfasterX:
Imei = fsg partition

Baseband = modem partition aka /firmware mount point (you will find modem*** files there)

Besides this the modem partition have the files needed to hear sound and get sensors and camera working. That's why the partition name is misleading and the mountpoint name is fitting better.

I tested to get cell service by flashing other modem partitions and by just replacing modem files without success yet. At least for the ls991 method this works for h810 and h812 but it seems not for the h815. As said the baseband files are ofc completely different for the devices even the names! Which is the reason why the ROM must be compatible.

Do you see your imei in settings and by using dialer code *#06#?

Do you see a baseband in settings or is it unknown?

Baseband works together with factory partition if that doesn't match it's one of the possible reasons. It's known that even a baseband stated as unknown can work fine though.

This may also can be fixed by erasing modemst1 and modemst2.

modem partition must be compatible with the ROM though.

Restoring imei is always like this:

Flash your fsg backup. If you have none go to the official TWRP thread(my sig) and click the announcement link at top.

If the imei is not restored by fsg or the manual rewrite erase modemst1 and modemst2.

This worked 100% in all my tests.

sfX
[G4 General] deniz1905:
H815TR

Android version 6.0

Software version V20i-TUR-XX

anti-rollback v0
[G4 General] augusto1024:
LS991

Android Version 6.0

Software Version LS991ZVF_01

Anti-Rollback v4
[G4 General] onotor:
H815 SEA

Android Version 5.1 (Rooted)

Software Version: V10C-OPT5-SI

No antirollback value listed
[G4 General] dianxxyyzz:
TWRP made backups of EFS : efs1.emmc.win and efs2.emmc.win , so no backup of fsg partition .

So this efs1 and efs2 backups I have can not help me to restore imei ?
[G4 General] ahoroba:
H812 Koodo (Telus Canada):

SW version info H81220z

FW version 6.0

Anti-rollback version 0
[G4 General] dianxxyyzz:
"evil programmer" blow a fuse responsible for user_debug mode . Once you use this programmer old one for user mode , will not longer work .

Qfill with non debug programer will no longer work , LGUP will not want to flash any normal KDZ , just the user_debug ones . So phone will be in debug mode , secure boot errors will appear but it will boot anyway any twrp and some boot images .
[G4 General] steadfasterX:
yes exactly this.

UPDATES!

I added some more news here: https://xdaforums.com/showpost.php?p=73950915&postcount=109

NEW UPDATES!

state updated: https://xdaforums.com/showpost.php?p=73950915&postcount=109

sfX
[G4 General] dianxxyyzz:
So now flashing with qfill H815 works ? Or just from sdcard ?It is still v0 rollback ?
[G4 General] steadfasterX:
no. i can qfil currently whatever i want it just do not boot anything.

due to this i cant verify any ARB

sfX
[G4 General] dianxxyyzz:
This was my problem too . But LS991 bootloader worked .

---------- Post added at 09:28 PM ---------- Previous post was at 09:24 PM ----------

LS991_ARB_02_RecoveryImage.zip Allways works for me , when other did not worked .

So when I Qfill the files from LS991_ARB_02_RecoveryImage.zip ,allways worked to boot .

But I do not know if is evil programer or if it will increase your rolleback version.

All I know is v2 roollback .

I'm sure for you will work too , but I do not recomend you to flash it until you try other methos first.

Maybe the problem for you is just gpt , or some corrupted partition .
[G4 General] steadfasterX:
I have tried everything I can think of:

- I flashed with Infinity Box (no QFIL!): H812 (ARBv0), F500v30 (ARBv0), H815 (ARBv0), H818-India (ARBv0), H818-China (ARBv0), H819 (ARBv0)

- I erased GPT to enforce sdcardboot for sure and then flashed on sdcard every image : H812 (ARBv0), F500v30 (ARBv0), H815 (ARBv0), H818-India (ARBv0), H818-China (ARBv0), H819 (ARBv0)

- I flashed with QFIL: H812 (ARBv0), F500v30 (ARBv0), H815 (ARBv0), H818-India (ARBv0), H818-China (ARBv0), H819 (ARBv0)

I really wonder what happened on the journey here.. i have always used the good firehose and ensured not to use ARB >0

I will now flash the v2 ls991.. i see no other option.

sfX
[G4 General] dianxxyyzz:
I was in this problem too . You can maybe inspect what files is in LS991 and modifi your h815 qfill .I still is not good to increase your v0 to v2 .
[G4 General] steadfasterX:
i have tried that as well with different model files
[G4 General] steadfasterX:
Some more news...

I have tighten the screws...

... huh.. what? what does that mean?

This means.. The endless time of 9008 mode testing is over where I needed to shorten PINs to bring back the device to life (to be able to do this I needed to loosen the screws of the back cover ;) ).

This also means: A decision has been made.

I will

not

continue the

H811

unlock method because even if this will work for some device models like the H810 it is no universal unlock for everyone and as I cannot make it work on a H815 I cannot hardcore testing it.

So no H811 unlock will come here

.

So far so good but what next?

Back in history I tested the H811 unlock with just replacing the aboot (now I look back and think about this OMG how naive I was...)

Then I tested another method which is a combination of leaked files plus QFIL and I successfully unlocked mine and several devices but it had limitations (see OP)

Then I tested the H811 unlock again but much more advanced with replacing the full bootloader stack and by using QFIL, Infinity-Box and Octoplus and it still doesnt worked out

So I went back to the second method where I had the most success and try to fix almost all limitations (except the fact that you cannot go back - this will be

not

fixable)

TLDR;

I will use the method described in the OP (again) as this is working on every device and I started to fix the rest of issues stated in the OP now.

Bonus

This old and new method brings us 2 new extras not available for usual devices:

1) after this method you can directly boot into fastboot by plugging in a USB cable and pressing volume down while inserting the battery!

2) this one I found yesterday by accident LOL: you can now press power and vol+down and keeping both pressed whole the time (not releasing power button to see factory reset!) and.. TWRP boots up :)

So this all is even better then all official unlocks can do for you ;)

I spent now weeks (I really talk about the effective time spent) on that issue and I really feel like we are about to see the finish line coming up

I also have to to give a big thanks to [MENTION=6051044]dianxxyyzz[/MENTION] who is supporting me in these last steps to take. This is really awesome as before I was completely alone working (besided those brave testers ofc!!) on this but now we have 2 stupids trying to fix those!

so stay tuned or be scared :eek:

sfX
[G4 General] අධිරාජ (Adhirāja):
Hi, I have a question for user SePhIrOtX:

I read the possible things that can go wrong.. it is a pretty big list. Have you come across anything failing?

Because I have this exact model, and I too want to unlock bootloader so I can install TWRP and custom rom.
[G4 General] SePhIrOtX:
Nothing have fail during the process. steadfasterX was accurate about anything that he said. Trust me, if you follow every single step and you're a smart guy, it cant failed. You have a good person for the G4 communauty. Its because of people like steadfasterX that the things are on a second level.

Sorry I'm french from Quebec, my english is not perfect...like me :)
[G4 General] dianxxyyzz:
Any news about call service ? Anything resolved?

Thanks!
[G4 General] Engelm:
Device: H818P

I don't know if it is needed, but the

v29a H815 ROM on the H818P (link) is

Anti-rollback v0

Before this ROM I had MM via OTA at the latest Version so H818P should be safe.
[G4 General] steadfasterX:
... the END?!

ok folks.

this may be the end now. .

I had so much success and failures, hard-hard bricked including mainboard replacements and success again but in the end, I have to admit that this bootloader

defeated

me.

During my further tests i somehow brought my device in a state where it cannot load the previously working firmware data anymore. The kernel dmesg and logcat showin clearly that I cannot load the firmware data anymore which is totally strange..

Before I was able to to get the camera and sound working but this does not apply anymore. I tested with all available firmwares and none of them allows me to give me back the previously working state.

This means my hands are now tied - besides the fact that i cannot use my device for anything else then WiFi..

I can unlock

any

device now but I can not solve the modem issue. So this method will work just for the LS991 without any limitations.

Regarding VS986 .. it should work the same as for the LS991 so

without

limitations (unfortunately I have no testers yet - so I cannot say for sure atm)

Regarding H810 and H812 .. it works fine in general but with limitations regarding frequencies so e.g LTE/4G/3G(?) may not work.

Regarding H815 .. I dont think that any model of it will work - unless someone (not me - I gave up on this issue) fix the modem / or better firmware issue

Regarding H818 .. I dont know - no tests were made here and I cant say anything regarding it. I saw that you can install F500 nougat on a H818 so .. maybe it would work the same as for the others.

Regarding F500 .. I dont know but there are chances that it will work like the H810,H812 so with some limitations

My approach was to unlock any device and to fix all limitations. It seems that this cannot be done - at least I'm not able to do so.

I will release the needed files including the howto with some further details in a separate thread soon.

You could then try on your own if you like or in case you have one of the working models - enjoy the unlocked experience.

sorry but i have to stop it now. For the next few weeks I won't be working on it any longer, to avoid getting more frustrated than I already am.

Thanks all for your continues support and motivation. Take care.

Cheers.

steadfasterX

EDIT (20171107):

...... and regardless of what I said above...

the story goes on

.. you ever wondered about the meaning of my nickname?

"steadfast" means "never give up". This is my credo since ever.. Well there is a point where this can't be taken any longer but this is not now it seems...

Read on here:

the forth approach to break the chains

Cheers

steadfasterX
[G4 General] mwahahaa:
Sorry to hear that LG has won! I know you have worked many long hours on this project. Hopefully some G4 users will be able to benefit from your efforts. I am eager to find out if my Telus H812 is able to use LTE with this method.
[G4 General] fates13:
I have a VS986 that I would be willing to test on if you believe that the risk of hard bricking is very low. I believe the antirollback on it is v1.
[G4 General] nailyk:
Donate to steadfasterx

i think it is the perfect time to click on SteadFasterX donate button ;)

He made a lot of work, spent lots of nights on this, and.... broke tree time his devices!

Am sure he will make amazing work on a "new" device (rom, mods, etc...)

Thanks in advance for him :)
[G4 General] steadfasterX:
I havent tried it but there are reports that u can enable bands with an app named Network Signal Guru ...so maybe..

nailyk as much as I appreciate your idea and that you want to honor me but I want to add this:

really.. a donation is

not

required or anything I would expect. I mean ok it would be nice to have at least my money back for the infinity box dongle and the octoplus dongle but I bought those without any donation in mind.

it was my decision for learning purposes and im fine with it.. I'm not fine with the result here but thats another story :p

.. and tbh:

I like thx clicks :good: more then money

:eek: !! lol..

Afaiu the following I feel like LTE will not work without modifications (in ROM likely) as Sprint and Verizon using different bands :

https://www.androidcentral.com/what-radio-bands-do-i-need-my-unlocked-phone

The situation described there is a bit different bc you would come with a ls991 device using a verizon SIM so voice and text may work..
[G4 General] xstuffx:
Has anyone considered this method for enabling frequencies?

https://xdaforums.com/galaxy-s5/general/how-to-add-rf-lte-frequency-bands-to-t2886059
[G4 General] fates13:
Would it be difficult to get LTE working? I absolutely cannot be without LTE on my VS986
[G4 General] steadfasterX:
I don't know. It may just work, it may just need some adjustments or it may never work.
[G4 General] ChiKaLiO:
so any changes any news ? this method seems dangerous.. is it safe ? can anyone make a video pls ! i need to unlock this phone it's almost a month now with lg software i can't stand it anymore !
[G4 General] steadfasterX:
It isn't dangerous but it has limitations and is not tested on all g4 models.
[G4 General] ChiKaLiO:
What are the limitations? I'm on f500k
[G4 General] steadfasterX:
Read the OP.
[G4 General] ChiKaLiO:
Nothing mentioned about f500
[G4 General] spartan268:
Same limitations as he listed in the OP.
[G4 General] steadfasterX:
All the good things... are THREE?!

ok guys. this is the third time I need LG's repair service..

During my attempts to "unlock" the modem partition I prepared QFIL files for ZV9 instead of the current ZV6 ones. ZV9 and ZV6 have the same ARB so no issue with that ( I thought... ).

... but somehow the device behaved different after doing so. Before I was able to use the camera and had sound when I flashed the correct modem partition but not after using ZV9 bootloader stack.

Again ARB is the same! so wtf?? I tried it with ALL available ROMS (about 15 for different Android versions as well) but nothing. I cant get it fixed again.. I can boot anything i want but the modem partition made me sad.

Well then I get frustrated and went into vacation and after coming back there is a guy telling me that he flashed a TOT file which then would make "secure-boot off" on his device. wtf?! that would be great if true!

I do not want say he lies... it could really be the truth as those TOT were the ones which disable the big cores and just containing the modded aboot. Those are leaked files from LG like the ones I use in my unlock process.

So the only way for me was to flash the aboot of that TOT to see if its true.

flashing a corrupt/wrong/invalid aboot itself was never an issue in the past for me as it doesn't matters that much. I can bring up the 9008 mode by shorten the PINs and go on.

it bricked.

And here I decided to stop again.

Flashing ZV9 was a bad idea so my device is f*** up anyways. I will be able to recover it by shorten the PINs but why should I do so? In the current state I cant bring it back to a working state it seems.

So I will send it back to LG and ask for a repair.

will go on when its back ;)

sfX
[G4 General] bravac:
has anyone tried doing this on a vs986 and using on tmobile (don't need the cdma bands)?
[G4 General] steadfasterX:
no.