yashsingh1/xdaforums huggingface dataset:
[G4 General] rizkhan999:
Unlocking a Bootlooped H811

Dear steadfasterX!

This is just an info message.

Trying to unlock a bootlooped H811, I wiped its MISC and DEVINFO partitions by the python2 partitions.py --wipe command and then restored in it the MISC and DEVINFO partitions of an unlocked H811 by the python2 partitions.py --restore command. Then I rebooted but didnt see the bootloader unlocked text at the top of LG logo screen.

Since this locked H811 was already in bootloop, I couldnt boot into fastboot by executing adb reboot bootloader command. So I wiped its BOOT partition and rebooted hoping it might lead to fastboot mode but it didnt. There was one change though. LG logo was flickering now. I then wiped RECOVERY partition as well hoping for the fastboot mode again. But still I successfully booted into stock recovery where I opted for factory reset and that green android icon revolved. Means the whole process completed as normal without any sign of fastboot mode. I also opted No in stock recovery which lead to the LG logo again. So no success.

Means unlocking a bootlooped H811 is not so simple as I thought it to be.:(
[G4 General] steadfasterX:
as u own a h811 the key combo may work for you:

battery out, vol down (keep pressed from now on!), usb cable in, wait for battery symbol, battery in, wait until u hopefully see fastboot, release vol down.

if that fails:

battery out, vol down (keep pressed from now on!), battery in, wait 5 sec, usb cable in, wait until u hopefully see fastboot, release vol down

just to ask the obvious: you tried to unlock a h811 with the backup of another h811?
[G4 General] rizkhan999:
Yes. I tried to unlock an H811 by using the backup of an unlocked H811. Both phones were on v20p firmware but that may be irrelevant in this case.

No I do not own H811. I borrowed them from others. But I will try these hardware methods to boot into fastboot in sha Allah.
[G4 General] rizkhan999:
Unlocking Bootlooped H811 by Comparison of Partitions

In reference to our discussion here regarding the mentioned subject, I am attaching herewith the MISC and DEVINFO partitions of a working H811 (v20p)

before, during and after

unlocking its bootloader. The description of attached files is:

-> misc1 and devinfo1 were dumped when Developer Options were enabled but "Enable OEM Unlock" and "USB Debugging" options were still unchecked/disabled.

-> misc2 and devinfo2 were dumped after only enabling the "Enable OEM Unlock" and "USB Debugging" options.

-> misc3 and devinfo3 were dumped after completing the bootloader unlocking process (i.e. executing "fastboot oem unlock" , then verifying it with "fastboot getvar unlocked" and rebooting into phone normally by "fastboot reboot").

However, in all three times, I took the complete system backup with default option (> 64MB partitions skipped) by the python2 extract-partitions.py command. Now the files are here for any comparisons if possible. In case you need any other partition files like modem etc. before, during and after unlocking, they are also available.:o
[G4 General] steadfasterX:
Amazing stuff thanks!! I will come back to you when I need more / other partitions. You could do a md5sum on all partitions to find those who changed during the both steps! This could give us more insights what partitions are involved.

Usually persistent and drm get changed too but for the h815 it doesn't matters for the unlock part.. Maybe it does for the h811..

But do the md5 maybe there are others interesting ones involved...
[G4 General] rizkhan999:
Well I have compared the md5sum. And OMG! There are a total of 9 partitions that have changed :eek:. devinfo, misc, persist, modemst1, modemst2, persistent, drm, sns and mpt. It would need some real hard work to find out the exact differences between all of these 09 x partitions to reverse engineer the bootloader unlocking process.

I am sending you all those 09 x partitions for each of the time i.e. before, during and after unlocking. Please check your PM. Thanks.

Attaching the md5sum results of the mismatching 09 x partitions herewith. It shows which partitions changed after doing what.
[G4 General] steadfasterX:
yea amazing. thx again!!

the unlock state when doing fastboot oem unlock goes for sure (at least) to:

misc

the oem unlock setting may change something in:

misc, devinfo, persist, persistent, sns, mpt

those are relative sure not important:

modemst1, modemst2 and drm

The main part is still misc partition. I strongly believe that all the rest is not important (MAYBE except for the android settings->oem unlock button). misc is like the configuration store for everything which is important for the device and we know already that h815 needs only that to re-lock / unlock.

This is my theory:

We know how LG implement that unlocking process for the international h815 where you need a challenge/response with the device-id and imei.

This will result in a signed hash which then goes to misc partition (known). That hash gets validated each time when booting (known) and if you try to use an unlock file from another h815 it will violate that check (known).

I strongly believe that the same is for the h811 with one major difference: there is no intermediate step between (the LG unlock file gen) but! instead a valid hash gets autogenerated when doing fastboot oem unlock.

Thats the reason why you cant use the misc of another h811 because it still depends on the imei and more important device-id.

Note: the device-id cannot be changed. The imei can. So there is no chance to trick the bootloader here.

I will investigate the files you send but tbh i believe even then .. there is no big chance to get auto unlock by using a single partition for any h811.

but! we may find the setting needed to be able to use fastboot oem unlock when u never used that oem unlock button in android..

Cheers
[G4 General] rizkhan999:
Previously I flashed 02 x partitions i.e. MISC and DEVINFO of an unlocked H811 on a locked one. And couldn't acquire unlock. Now I have flashed all 09 x partitions of that unlocked H811 on a locked one. And the good news is that:

LOCKED H811 IS SUCCESSFULLY UNLOCKED!!!:laugh::highfive:

This was evident when I booted and the phone showed the bootloader unlocked message on the top of LG logo screen (which it didn't show when I had flashed only 02 x partitions). But I think acquiring unlock this way was expected. But what is astonishing, and infact, annoying is that a mere enabling of a check box and a fastboot command (seemingly so simple) effects 09 x partitions of the phone!!! And this makes the unlocking procedure for H811 pretty tedious to reverse engineer.

Anyways, I couldn't verify the unlocked status by fastboot command since the phone was already bootlooped. And the hardware procedure you sent also couldn't fetch the fastboot mode on 03 x H811's that I have tried it on, which makes me think that this hardware method is not applicable to H811's.

For info, in this unlocking process, I used an 8GB memory card formatted with FAT32 and copied bin files of all 09 x partitions on it. Then I executed the following commands using LGLAF (auth) in FWUL:

mount -t vfat /dev/block/mmcblk1p1 /storage/external_SD
dd if=/storage/external_SD/mmcblk0p17_devinfo.bin of=/dev/block/mmcblk0 seek=254976 bs=512
dd if=/storage/external_SD/mmcblk0p22_misc.bin of=/dev/block/mmcblk0 seek=262144 bs=512
dd if=/storage/external_SD/mmcblk0p23_persist.bin of=/dev/block/mmcblk0 seek=294912 bs=512
dd if=/storage/external_SD/mmcblk0p24_modemst1.bin of=/dev/block/mmcblk0 seek=360448 bs=512
dd if=/storage/external_SD/mmcblk0p25_modemst2.bin of=/dev/block/mmcblk0 seek=363520 bs=512
dd if=/storage/external_SD/mmcblk0p35_persistent.bin of=/dev/block/mmcblk0 seek=380928 bs=512
dd if=/storage/external_SD/mmcblk0p40_drm.bin of=/dev/block/mmcblk0 seek=655360 bs=512
dd if=/storage/external_SD/mmcblk0p41_sns.bin of=/dev/block/mmcblk0 seek=671744 bs=512
dd if=/storage/external_SD/mmcblk0p42_mpt.bin of=/dev/block/mmcblk0 seek=688128 bs=512

I had to use dd commands because the "python2 partitions.py --restore <file-to-restore> <partition-name>" command is extremely slow.
[G4 General] steadfasterX:
good job dude!!!

so just to be crystal clear: you flashed ONLY these above partitions on the sdcard? nothing else? no aboot, etc?

what happens when you take out the sdcard and trying to boot?

what happens when you leave out modemst1 and modemst2 ? or have you tried to leave out any of the others (except misc) ? Can we try this one by one to find out which are really required?

would be nice to see you in IRC ( http://webchat.freenode.net/?channels=carbon-user )which is better to chat then here..

SORRY just re-read it..

you havent flashed on the ext sdcard (which is another method but thats why i wondered) but replaced the partitions directly.. can we talk on IRC?

Cheers
[G4 General] rizkhan999:
Two things to add:

1. The already unlocked H811 was on 20p firmware while the now-unlocked H811 was also on 20p firmware already. I guess this is related to the MODEM partition but I still found it better to mention it.

2. I had to flash the custom boot image (with big cores disabled) of 20o firmware on now-unlocked H811 which was on 20p by now. So I flashed 20o KDZ on it using LGUP and booted. The unlocked state was still there and not lost. I extracted the KDZ and saw that the DZ includes only PERSIST partition from among the 09 x partitions that I earlier flashed to acquire unlock. Means PERSIST was overwritten and the unlock status was not lost. This may show that PERSIST partition does not have any role in the bootloader unlocking process. Therefore, we may now have "only" 08 x partitions to work on, instead of 09.:p Remember, "only" is in quotes.:D

Really apologize for the lengthy posts.
[G4 General] steadfasterX:
For those following this thread:

rizkhan999 and me talked a bit in IRC and we will do some tests to identify which partitions are required for the h811 unlock process.

Besides that some exciting news:

---------------------------------------------------------------

I found a new approach (iirc this is the forth!!!! one) to unlock your devices. And all this *without* the current limitations we have with the ls991 method I referring to in the OP...

It already worked for one user which will get all the credits for pointing me to this direction but first I wanna verify this and check for limitations.

Unfortunately my device is still in repair but I hope I will get it back this week.

That new method is not as dangerous as the ls991 method and if that would work.........

rizkhan999 will also try this method once we have finished the above tests (even when he don't need to as he can unlock his h811 already) but if you feel you can't wait you can find me in the IRC.

The ls991 method will work for any device as long as ARB is maximal 2. Any ARB higher then 2 will fail. The new method mentioned may have the same limitation regarding ARB.

Stay excited

steadfasterX
[G4 General] raptorddd:
congratulations to both of you. hope you achieve it. :fingers-crossed:
[G4 General] bayr691@gmail.com:
VS986 tester here

Sorry for my english because it's not my first language . I had hard bricked vs986 because of wrong firmware update. That's why my phone has h811 sticker on the back and running h811 rom. Also i could access fastboot mode. After software update notification phone turned off and installing update. But suddenly phone gets so hot and shuted down. I was shocked and trying to power on. But it was seems hard bricked. So i had to turn on the device because of some important things. After few weeks exploring internet so deep i found qfil way.at the first i only flashed h811 firehose files because of stupid sticker. But no success. Trying flash h815 firehose still no luck. After few days later i found ls991 firehose file and flash it voila phone boots up with secure boot official error phone had updated to 6.0 ARB V2 and no sound no wifi no camera etc blah blah blah. So i flashed ls991 firmware but no luck it go back 9008 state. I was annoying this. Also few weeks after i reflashed ls991 bootloader stack and i found advice that means before flash any lg first you have to check motherboard version. Then i checked my motherboard it says vs986. My friend told me you have to flash vs986 firmware. I trusted him and trying to flash firmware but no luck lg up regonize my device as h811. Afterwards i used to flash kdz with it infinity box then it booted up. Normally working. God blessed me haha. Everything is functional.

Sorry for long story

---------- Post added at 01:27 PM ---------- Previous post was at 01:16 PM ----------

After few weeks later i was trying to unlock bootloader but it's impossible due to vs986 v29a ARB version. i didn't check ARB version so can't access fastboot commands neither oem unlock function in settings due to verizon software.

Edit: if i installed lower ARB version i could unlock bootloader. Also i'm testing it with f500l.
[G4 General] rizkhan999:
Remarkable achievement no doubt. And sorry to keep you busy so much :S Wanted to ask have you been able to boot H811 aboot (fastboot mode) by any method other than "adb reboot bootloader" command as you hinted in this post?
[G4 General] steadfasterX:
you write: "Afterwards i used to flash kdz with it infinity box then it booted up. "

Which KDZ did u flashed on your vs986 device with infinity box? h811 kdz? which firmware version?

Yes ARB is important and you cannot install firmware from a lower ARB - it will hard brick (recoverable by qfil or infinity)

If I understood you right you have unlocked the bootloader ? on which firmware? h811? vs986? which exact firmware version?

.
[G4 General] steadfasterX:
nah all fine ;)

no sorry. the hardware key combo is burned into aboot and so is different or just missing in some models.

.... but I erased

boot

partition millions of times to

force

fastboot mode which works fine for the ls991 at least and maybe for all. So give that a try if you can handle an empty boot partition :)
[G4 General] rizkhan999:
I wiped boot in one H811 with 20p firmware. But still it didn't lead to fastboot. The LG boot logo screen started flickering infact. Seemed like the phone was trying to boot the boot partition again and again and again...... but couldn't find it.
[G4 General] rizkhan999:
Another VS986 Tester here!

Dear developer!

Will share my H811 unlock findings soon in sha Allah.

In the meantime, remember my "so-called" H815 (it had an H815 label at the back and H815 software installed) was on 9008 mode because I flashed a modified TOT file of H810 over it using LGUP. So I was trying to flash the H815 QFIL recovery files that you had provided here but the error that continued to be displayed (as I also shared in that thread) was that the phone was not in the firehose mode, while apparently it was.

I just btw managed to disassemble that phone and it has come out to be a VS986!!! (picture attached). So I guess I would need VS986 QFIL recovery files right! But I also want to unlock it thereafter. And with that in mind, I think the recommended way would be to convert it to LS991 right? So in the first step, would I need the VS986 QFIL files with ARBv0 or any ARB but <= 2? And from where can I get those files from?

I can be your tester for VS986 as well :) and my case seems similar to that of bayr691 above. He also had vs986 in 9008 mode but in h811 disguise and I also have vs986 in 9008 mode but in h815 disguise. But unluckily I dont have the infinity box like him. I can only hope that QFIL recovery works in my case :(
[G4 General] steadfasterX:
I have the infinity box(software only). So we can try to recover via remote session if you want.

The important question is what ARB do you have NOW on your device.. Depending on the ARB the methods or better files djffer and if the ARB is too much increased there is absolutely no method available to recover. I was in that situation two times. No octoplus, no infinity, no qfil. At least not without jtag blabla which I can't do. So at least no firehose method will recover you then.

Nevertheless it's interesting that you were able to flash (or better it was flashed) a h815 ROM on a vs986.. Btw where do you live? Do you had all basebands when using the h815 ROM? Even cell signal?

Either your PBL was changed or the vs986 allows booting a sbl of a h815 in general (more likely).

It is e.g. possible to boot f500 or even 812 from a h815 but not a h811 from a h815. One reason: the certificates accepted by the PBL which is different depending from the model.

The hardware is the same between all models but the basebands differ which can result in no signal or signal but no 4G etc.

The above is all nice and fine but... Now a dirty player steps into the game: ARB.

Once triggered all the above will change. You cannot reverse it (it's an efuse which when it's blown it's (afaik) physically blown).

Once ARB has been triggered you cannot boot any bootloader stack with a lower ARB. It will directly brick into 9008. I guess that's what happened to you and bayr691.

As all h815 ROMs are ARB 0 you cannot flash a h815 ROM anymore once ARB has been triggered. That's a fact!

The only choice you then have is using a ROM with the same or higher ARB but beware : as mentioned ARB cannot be reverted and so before flashing anything DOUBLE CHECK the ARB of the KDZ/TOT or my http://tinyurl.com/antirollg4 list or just ask me and I can find out.

Think twice before flashing a ROM with a ARB in general but think three times before doing this with a higher ARB. You cannot go back..!!!

Before doing something we cannot recover from we should try my brand new method with the other leaked files. The problem is that I have no vs986 files but we can try others.

The other thing I can offer is using infinity box software too.

Pls let us meet in IRC again as that is much easier to handle and I don't wanna share anything untreated to the public.
[G4 General] rizkhan999:
When I got the phone it already had H815 10H firmware installed, surprisingly with ARBv2!!! I shared its screenshots here when it was alive. There is one 10H firmware here but I guess it is ARBv0. So I don't know from where someone got the 10H ARBv2 and flashed on it. Anyways. When I tried to flash any other available H815 firmware through LGUP, it always gave the antirollback version error since all H815 firmwares available online are with ARBv0. More interestingly the LG Mobile Support Tool (predecessor of LG Bridge tool) showed the current firmware version as H815 10h but said that an updated firmware with version VS986 24c was available!

Anyways, then I downloaded the TOT of H810 10o ARBv2 available here, replaced all instances of H810 in it with H815 (so that LGUP might not give the invalid file error) and flashed via LGUP. And thus the phone bricked.

So it was ARBv2 when H815 10H was there. And the same ARBv2 when it is H810 10o now in the bricked phone. I hope since ARB<=2, the phone may be recoverable?

Btw I live in Pakistan. I didn't get the opportunity to use the phone much but afair everything worked on it on Zong (network) as well as the wifi.

Sure.

EDIT-1: Another user (from India) also had H815 10H with ARBv2 here.

EDIT-2: I have confirmed that 10h here is ARBv0 (screenshot attached).
[G4 General] bayr691@gmail.com:
@steadfasterX

I'm confused with bootloader and it's stupid commands. What i need to unlock bootloader. You said in here: flash all partition and erase userdata then flash twrp right? But ARB is required to unlock bootloader or not? I can access fastboot. Trying find to unlock bootloader without convert. I think that all boot chains under the aboot permission so if we want to unlock bootloader then we simply flash modified patched aboot. But surely answer is no because of LG's stupid encryption. I have LS991 kdz and extracted all partitions. I'm ready for testing. Still looking how to unlock bootloader easy. In some way lgviet shows twrp works in LG G4 F500L but no downloads. I think that they create custom unlock.bin and unlock then flash twrp. I see another VS986 tester here. He cannot flash kdz without infinity box. Don't worry download antblack box program and access infinty software without box. Before i buy my infinity box i was access miracle software with it.

Also my answer is

NO i coudn't unlock bootloader but it can access fastboot. I need to know flash partitions required to unlock bootloader.
[G4 General] rizkhan999:
[MENTION=5545101]steadfasterX[/MENTION]

One question. If we can edit any partition after unlocking the phone e.g. boot, system etc without any problems, why can't we change the ARB value in the SW_ID field contained in both aboot and sbl1 partitions without any problems (by dumping both partitions from the phone to our computer, editing them and then restoring them back to the phone and thus achieve a lower ARB version)??
[G4 General] tulen_kobi:
ARB is hardware variable, once it is on v2 it can not go back.
[G4 General] steadfasterX:
Yes as long as you stay on ARB v2 we have the chance to recover.

Dude. You can read through the whole thread but in short it is NOT that easy. At the very first beginning I thought a patched aboot will be the trick. it forget it. There are only 2 chances to achieve this:

1. You have the private key to sign a modified aboot (which you will never get anywhere)

2. You find a bug in the aboot code after disassembling aboot

Both are very unlikely to happen.

And just to be clear there is nothing encrypted anywhere. It's just signed but a signature is enough to validate and so brick a device of you modify a single bit of it.

I tried that all already and I found no way to achieve the one or the other but I'm not good with assembly code...

I can say for sure that modifying any partition of the bootloader stack will brick the device.

The bootloader stack which has to be valid and compatible with itself are those partitions :

sbl1, aboot, pmic, rpm, tz, sdi (and as I have no access to my pc atm maybe I miss one)

You can boot the bootloader stack of another device but this may not work for another device model. the reason is the PBL which can't be read or flashed as it is on read only memory of the device. The PBL decides if it will brick or not.

:) as said it's a physical blown fuse. You can't unblow a fuse. That's the reason for what it is made for. The SW_ID which I check on device and firmwares is just a value within the certificate. We can't change it. Well we can but then the signature gets invalid and the device will brick.
[G4 General] TjoyD:
Thank you very much for your guide.

I followed several steps well and Fortunately, I got a unlocked bootloader and now I have Nougat with root.

Could you please share boot_permissive.img or editing guide?

Because boot process was an stopped when I tried to modify the boot.img.

First, I unpacked original boot.img from stock KDZ

and added the new line 'export LD_PRELOAD xxxx' line to init.environ.rc.

Next I repacked new boot.img and flash my phone was stopped at the boot logo.

So, I also tried to delete line from new boot.img (not original) and flashed in TWRP, It was able to boot normally.

I guess it's because of SELinux security, so I ask for a file.

Many thanks in advance.
[G4 General] the_naxhoo:
try with this https://goo.gl/8bGQCZ
[G4 General] TjoyO:
boot.img

Thanks for your reply.

This img works fine.

I was able to verify 'Permissive' with getenforce command just flashing this img.

But I couldn't get what I wanted. Modifying the export LD_PRELOAD x.so option from the init.environ.rc file was rejected. Stuck in boot logo.

Thank you anyway.
[G4 General] steadfasterX:
What device model do you own?

Repacking requires to take care of the dt image. If you forget it it will fail.
[G4 General] TjoyO:
Device

My device is F500K. I didn't care about the dt.img because I didn't know much about them. This approach is because there is no problem before (LG G, G2).