yashsingh1/xdaforums huggingface dataset:
[G4 General] cablematicman:
Thanks for trying to help! I edited my post at the same time as you were replying to it. I deleted my stupid questions. I'm just going to go for it and deal with the consequences if there are any.
[G4 General] adam_s_459_:
Let me know how it goes. I have an H812 and it's my only phone....... so I'm slightly nervous.
[G4 General] nummer:
Are you talking about the SALT tool? Is that the thing that will be doing all of this?
[G4 General] fil3s:
I suggest you start preparing

https://xdaforums.com/g4/general/tool-salt-lg-revolution-t3717864/page19
[G4 General] steadfasterX:
Correct without SALT no unlock

I have updated the OP once again:

Before asking for an ETA ensure you read the Announcement link of this thread (requires a browser)
[G4 General] cloud1250000:
Hi [MENTION=5545101]steadfasterX[/MENTION]

is Usu based on a leaked file from lg? can it be ported to the lg g5?

I was wondering if i could try to port it.. i know i have to mod lglaf (in order to use it to flash from download mode on my g5) but i also see that the UsU magic is 3 img files to flash..

Should i come on irc for that?

Thank you
[G4 General] steadfasterX:
UsU's main part is based on a leaked aboot which is specific to the g4. No chance to use that on any other device then the g4 sorry.
[G4 General] birry:
Hi, can I make contributions with a H811 in qdloader 9008 status? It is ready to make any test!
[G4 General] steadfasterX:
Lol h811 can be unlocked by just a fastboot command but yes UsU will work even there ;) again no need to though.

You need to unbrick your phone first. Try the sdcard unbrick..
[G4 General] birry:
I already tried sd card unbrick and it didn't work :/ it has to be 32gb correct? Any particular file needs to be used for T-Mobile variant?
[G4 General] steadfasterX:
I refer to this guide :

http://bit.do/unbrick9008

Any further questions about that there..
[G4 General] commandervadeo:
I was able to install twrp and aoscp on my lgg4 h812 by screwing around with it and cell works fine seems everything works fine other than nfc because i haven't tried it. I've never done the usu method just straight brute forcing* cell was working fine till i rebooted but now i cant hear/people cant hear me.*scratch about the issue i got an h811 rom of lineageos instead of h815 aoscp and it works! huzzah!
[G4 General] nummer:
Nice, can you point me to the rom/twrp? And how exactly do you do the BL unlock process for the h812? Would be super excited to try it out for myself :D

EDIT: Is it possible to flash ant custom rom specifically for h811/h815 for h812? Because i would like to have a RR rom for my h812 because i like all the customization it offers :p
[G4 General] commandervadeo:
tbh im not gonna post it yet because I can't get lock screen passwords working. im trying to see if its a hardware issue or software issue. 2 roms i doesn't work with hope 3rd rom the charm! ;) That and i'm also super sketched about it because my device still thinks its locked but i can run custom kernels no issue.
[G4 General] sdembiske:
You are barking up the wrong tree here. You are asking for advice and guidance from a fellow who didn't really understand the ramifications of what he was doing. Frankly he is lucky he hasn't bricked his device and had to take it to the recycling depot or at a minimum have had to replace the motherboard, yet.

So many members posting to here lately really don't seem to understand the research and testing and time that steadfasterX has put into to minimize the risks of cross-flashing different model firmwares or custom roms on bootloader locked devices. Running off half-cocked to ask these type of questions in different threads etc, is useless at this stage.

Wait until steadfasterX releases the guide to the public - it will be covered and explained. No other member has done more in this area than he has or has gained the knowledge that he has. You're spinning your wheels ...
[G4 General] steadfasterX:
I'm glad that you somehow find a way to install custom ROMs on your device. But this thread is about UsU so please open a new thread with your findings . thx
[G4 General] අධිරාජ (Adhirāja):
Regarding custom roms... I hope they still keep some of the stock lg apps because I really like them (especially the camera and IR blaster apps)... And hoping they will support the FM radio also
[G4 General] commandervadeo:
couldn't of said it better myself! :good:
[G4 General] sdembiske:
This is this type of member I refer to in post # 505 above (he has been posting questions re: roms to flash on his H812 on other threads where the authors do not know or understand the full process as steadfasterX does) i.e., the kind of member steadfasterX I suspect is concerned about in taking his guide public.

If you want your LG G4 stock apps stick to LG G4 stock based roms. Even with other model LG G4 stock roms, such as the H815, some stock apps, like FM radio may not work ... and as far as custom roms having stock LG G4 apps that is wishful thinking, IMO. Most, if not all of the stock LG G4 apps are 'private' - proprietary coded so unless they decide to suddenly make them open source it is doubtful that you will see them ported and if someone manages to 'crack' them, there is no guarantee they will work as intended.
[G4 General] fil3s:
I dunno bro. I just want ressurection remix 6.0 apps. :good:
[G4 General] nummer:
Hi,

When i go to the UsU unlock menu, it says to provide images for aboot, laf and rawres, but i do not have these files.

Can anyone provide links for these files? [for h812 specifically if poss?]
[G4 General] steadfasterX:
you havent read much of this topic right? UsU is not released yet and before asking for an ETA read the announcement link in this thread (only displayed in a browser)

.
[G4 General] Makifylmz:
I'm very glad to hear you are so close to get it done. Thank you for working hard on UsU.
[G4 General] nummer:
Yeah, I'm doubling up on that too, this is truly amazing :D
[G4 General] fil3s:
:highfive: lg really screwed up with their 'ultimate locked down BL'

:highfive: they should have shipped em with mm. :highfive:
[G4 General] nummer:
LG tries, but we get our way anyway :highfive:
[G4 General] Jonotjie:
Could we please stop with the pointless posts. Some of us are following this thread and keep getting notices for useless posts.
[G4 General] steadfasterX:
This is the very last post in this PoC thread.

R.I.P PoC ;) -- THREAD CLOSED --

ah yes... and btw .. it's out: https://bit.do/unlockg4

have fun.. :victory:
[G4 General] BIG_BADASS:
Ah, sorry, I never saw this. So once an H81x undergoes this process, it is no longer an H81x. In fact, it is anything BUT an H81x.

The saying "If it looks like an H81x, functions like an H81x, then it is an H81x" is no longer applicable, even if it is labelled as an H81x.

<Snip - Mod edit>

Anyways, another question to you MrSteadfasterX

how is this version better than the official method? Afterall, us users with European H815 and T-mobile H811 now have 2 methods to unlock the bootloader. What advantage does this method provide for us?

<MOD EDIT - Removed quote of a deleted post.>
[G4 General] Minto107:
Really? This method is not another way to unlock H815. It's meant for users that can't unlock their G4. If you have H815EU then there is no advantage of this method. It permanently voids warranty, is irreversible, can lead to serious hardware damage of your phone.

Wysłane z mojego LG-H815 przy użyciu Tapatalka
[G4 General] BIG_BADASS:
It can be used on devices that can be officially unlocked also. It will work on H815 EU model
[G4 General] Minto107:
That's why I said there's NO advantage of this method over official unlock. It WILL work on H815EU, but it's not recommended to go this way unless for some reason you can't go with official unlock

Wysłane z mojego LG-H815 przy użyciu Tapatalka
[G4 General] BIG_BADASS:
Ok thanks for your opinion. Now let's say what SteadfasterX has to say to this.
[G4 General] daiskun:
That's not an opinion. It's a fact. If you have EU model then you can use the official method, there is no advantage in this method for you, it's intended for non-officially-unlockable models
[G4 General] fawadshah33:
I have H815T and have flashed Qfil. If you need a tester let me know.
[G4 General] chucky43:
Do you have a Turkish citizen to assist
[G4 General] steadfasterX:
I've updated the OP for this right now to be even more clear.

please read the topic:

Participate / Support / IRC Channel

in the OP

see u there

.
[G4 General] shadow775:
Do you have to have a lower firmware for this to work, I have have the Ls991 with zvg and another with zvb mellow mallow.
[G4 General] steadfasterX:
not sure if i got what u asked..

You want what?

.
[G4 General] shadow775:
The question was could the boot loader be unlocked with firmware zvg or zvb
[G4 General] fawadshah33:
my mainboard has EAZ66585501_H810_MAIN_1.0 written on it.

Used OP method and can boot in TWRP.

But dont know which boot.img to flash. I have already flashed H810 boot.img

I get

secure booting error

1002

MODIFIED!

and then TWRP starts.
[G4 General] steadfasterX:
I don't know until someone tests it.. It depends on the qfuses and I do not own a ls991 so i can't test it.

Forget about what you had. Now you have a ls991 as you used that method.

Flash ls991 zv6. Do not use any higher version for now.

You can even use the tot file of that ROM to flash in download mode.

You CAN flash another models ROM (e.g. H810) but this requires you to repartition first and/or flashing some important partitions of h810 manually.

For this prepare yourself for IRC first. I do not want to post things here which are such dangerous as long not every step is clear and verified.

.
[G4 General] fawadshah33:
Thanks bro as directed by you I have flashed ls991 zv6 tot.

System is running well and smooth but was getting handfree activation, hence used fixLS991ZV6byGPA to bypass activation.

Still getting service disabled. In dire need of any tip :p.
[G4 General] steadfasterX:
Come to IRC tomorrow.

.
[G4 General] fawadshah33:
Thanks bro :D. Now working Converted to H810 using

LGH810AT-00-V10o-ATT-US-SEP-10-2015-ARB02+0_User_Secure.tot

Now I am interested in adding TWRP if its possible.

And Thanks again for your time and advise. You really showed me the light. :highfive:
[G4 General] fegitoli:
I hope one day there'll be a noob-proof way of doing this.:silly:
[G4 General] steadfasterX:
Flashing tot is risky that's why I said you should better come into IRC.... but you had luck. Pls keep in mind to not flash anything which increases the anti rollback version !!

For installing TWRP just check the OP it gives you the how to but you also need to extract the tot file to get out of the boot image which needs to be flashed in fastboot afterwards.

Btw: Signal is working for you now?

Once I get all working I will do so for sure

Tbh At the moment it is also very easy to do so because the only thing you need to do is go into IRC and I can guide you through or even do a remote session...

.

Another quick summary

It happened again.. While cross flashing partitions to fix the modem issue I have made it again: bricked my device. This time in a way where I really can't recover it anymore..

neutrondev and me are not sure why but it happened after flashing rpm+pmic of an anti rollback higher then 0. We assumed before that only sbl1, tz and aboot are involved when it comes to blowing qfuse but it seems we were wrong or at least not completely right.. :p

I currently try to get my device (hopefully) repaired again.. :p

So again: Thats why I said already clearly in the OP: Ensure you know your rollback version and do not flash anything before u know the KDZ/TOT one (which shouldnt be greater then 0)!

.
[G4 General] Moshan:
Can I unlock the bootloader of a H815 using this method?
[G4 General] steadfasterX:
read the OP.

Tip: find That means atm this should work for

.
[G4 General] dhepaa:
Is it possible for h818 dual sim version?
[G4 General] steadfasterX:
read the OP.

Tip: find That means atm this should work for

but assuming u had that already - here an extended answer for the special case of dual sim models:

It all depends on the fact if we can get the h818 modem firmware runnin or not.

I cant say more without testing but *atm* I think the chance is at ~10% that we can get at least signal/cell service and ~1% to have the dual sim working.

.
[G4 General] raggaro5:
I have a ls991 on marshmallow mellow mallow zvb is it possible for me to get twrp and has the chances increased of a non brick, ive read the op twice and figured id ask
[G4 General] steadfasterX:
The bad:

Zvb has anti rollback so this method will not work for you.

The good:

Vs986 and ls991 are kind of special.

That means the implementation of aboot (where fastboot lives) is completely different then for other devices. This can be your chance.. I have no testers for this brand new method yet so if you want to help the first step is 100% risk free:

Tick or swipe to enable the OEM unlock in developer settings and boot into fastboot. Make a photo of the fastboot mode (if you be scared about exposing the serial you can black it out or send it by PM).

It is really the easiest to see a photo of it but if that's somehow not possible write everything you see on the screen when in fastboot mode down.

sfX
[G4 General] steadfasterX:
ok folks some new stuff for you..

thx to [MENTION=8249555]SePhIrOtX[/MENTION] !! we have the first proof for a H812 just right now..

For this I had prepared complete new unlocking files which are hopefully non-fusing (means they should not blow the eFuse(s) anymore).

Until now we have some good proofs but none for the LS991 which would be one of the easiest! thats the one which is most risk free in this process and with most less limitations..

Besides this I took the time to write down the complete unlocking guide on this...

... i want to go through that one at least once with someone to see if it works as want it to be and then release it here (still without a public download - it is still an incredible risky process atm!)

sfX
[G4 General] fates13:
I have a VS986 but no oem unlock in settings. What info would I need to send you to see if this method is possible?
[G4 General] steadfasterX:
The same as above but you need to do this first:

https://xdaforums.com/verizon-g4/general/how-to-enable-oem-unlock-vs986-t3170556

sfX
[G4 General] dianxxyyzz:
Have you tried to copy all partitions from a unlocked H815 to a H811 ? I mean all partitions with full boot chain (laf , gpt,sbl,tz etc etc etc etc) and short the pins of h811 and use qfill to flash all ? That in theory must make the emmc of the h811 identical to the unlocked h815 .
[G4 General] fates13:
Here you go, it was exactly the same as was on the picture in the OP of the thread you linked lol
[G4 General] dianxxyyzz:
From what I know you can install a custom recovery on a locked bootloader G4 .

So here is my BIG question : WHY YOU DO NOT REPLACE RECOVERY.IMG WITH YOUR OWN CUSTOM BOOT.IMG ?

I mean you to flash inside recovery partition a real Lineage OS boot.img .

When you start the phone you choose to start in recovery , but it will load the lineage os kernel witch will start Lineage OS .
[G4 General] steadfasterX:
[MENTION=5937299]the_naxhoo[/MENTION] had the same idea a while ago with using the h815 as source plus the unlock bin..

The answer: yes that should work. But..

There is just one issue with that: you will have and need to use the same imei as your source (in this case of the h815 you cloned).

If you change the imei you will loose unlock!

If you stay with the same imei you may get trouble in the cell network.. Not sure if or what but..

But...

Mate..

BUT! On the very very early days my idea was to replace the bootloader with the one of the H811(!!!). Why? Because the H811 can be unlocked with a single fastboot command no unlock bin required!

The problem was : this bricked the device.

The time I tried this method was long before I discovered the qfil method and.. I never tried the old one combined with the new method.

I mean I was so focused to get the ls991 method working that I forgot about my early approach..

Using H811 instead CAN TOTALLY WORK

The reason is that we can restore or keep the imei on a h811 and just use the unlock command is enough! No imei issues and unlock can be re-done!

F** I have to test this! This can do the trick without limitations hopefully..

Thanks for bringing me back to my beginning ;)

No. There is absolutely no way to flash or modify recovery on the g4. TWRP is available for rooted devices which are locked but the implemented way is completely different and does not replace or modify recovery partition. Modding that partition will soft brick.

Nice ty! Looks like I expected.

If you want to test my idea drop me a PM and I give further instructions.

Edit: this idea has nothing to do with the above h811 flash as you may can do it without.

sfX
[G4 General] SePhIrOtX:
I confirm, worked the first time on my H812. Had a minor bug, my wireless 5 GHz ain't work since this time. Don't test it very well too, had a long day. Thanks again for your time and your files, sometimes we faced some walls but nothings is impossible. Keep you update tomorrow's. Will push the test a little more.
[G4 General] steadfasterX:
great! and if you don't mind.. we could convert your device to a H811 now :)

This way I can test if I was able to trick the fuse blowing and we can use the unlock command hopefully.. so if you like.. then I see u in IRC ;)

.
[G4 General] popy2006:
I'll think there is something coming [emoji16]

I would bet for the locked H*** users.

This would hopefully boost community activity....

Thx a lot for all, you guys rocking

Please keep us updated.

Gesendet von meinem LG-H815 mit Tapatalk
[G4 General] steadfasterX:
it will not (it hard bricks) and: you really need ALL of the other bootloader parts. they all belong together. miss one and it will not boot. I have tested all combinations already.

interesting. the information when unlocking a H815 is written into: misc, persistent and drm where the misc partition is the one responsible to have it unlocked or not.

flashing a misc of a KDZ and it will lock. flash the backup of an unlocked misc and it will unlock.

using an unlocked h811 devinfo will likely not work but I haven't tried it yet. The reason is that unlocking usually depends on the device id and IMEI. so it may work when flashing fsg (IMEI) and devinfo though.

but as that means having duplicated IMEI its not a solution.. I will try to find a h811 devinfo nevertheless to inspect it...

sfX
[G4 General] dianxxyyzz:
Thank you for your answer , if you need all parts of boot chain and not only aboot , that means they all have to be signed with same key or smth similar .

-------------------------------

Some info on how Qualcomm based phones are booted:

Built-in ROM Qualcomm bootloader (pbl — primary bootloader) verifies and boots sbl1 partition (secondary bootloader). sbl1 verifies and boots tz (trust zone), then aboot (Android boot, little kernel, lk). Then aboot can boot into built-in fastboot maintenance mode, do the normal boot or boot into recovery or fota.

Partition description involved at boot:

tz — Qualcomm Trust Zone. It performs low-level operations, including working with QFuses (rpmb secured mmc partition).

rpm — Resource and Power Manager firmware. Firmware for specialized SoC, responsible for resources and power.

sdi — trust zone storage partition. The data which is used by Trust Zone.

All of these partitions are signed by a certificate chain.

------------------------------------------------

From what we read here we only need sbl1 tz and aboot to be from same KZD. It looks we can ignore the rest of partitions . But maybe we need all partitions from rawprogram0.xml ,

---------- Post added at 12:58 PM ---------- Previous post was at 12:39 PM ----------

Any way , using the prog_emmc_firehose_8992_lite.mbn from h815 , that does not blow fuse , and just the strict required boot chain partitions , from a H811 that accept oem unlock command , we should be able to unlock any G4 . We must not use patch0.xml so we do not distroy the rest of partitions ,and the data from them , we must only use a stripped rawprogram0.xml that flash just the required boot partitions . We are very close and I'm 100% sure phones will not get bricked and all operations can be reversible .
[G4 General] steadfasterX:
yes unfortunately thats all known already. I know about the boot chain and boot process and you have to use the whole chain and they have to have valid signatures.

but thanks anyways ;)

Change a single bit of one of them and it will not boot due to mismatching signature.

as already mentioned we really need those to flash:

tz, sbl1, sdi, pmic, rpm, aboot, hyp - skip one and use a different one and you will just hard brick (9008 mode)!

u can leave out laf which is just the download mode though.

as said I tested to leave any of those partitions. and that was a dangerous thing!

leave out rpm and just flash tz or vice versa and you will hard-hard brick with no way to recover the device anymore. believe me I hard-hard bricked my device 2 times already.

Only mainboard change can solve that.

I flashed with a firehose plus nonfusing above partitions already and it does not work (hard bricks). I need to do some more tests here though.

I also need to identify a better test if it blows or not. atm i can only say for sure when its too late..

sfX
[G4 General] dianxxyyzz:
I understand you "hard brick (9008 mode)" and "Only mainboard change can solve that." but why you had to replace motherboard ? If you short 2 pins inside phone , use qfill and H815_ForFusingDevice directory ,you will flash back the boot loader . I deleted aboot partition , my phone was like dead but I short 2 pins inside phone and using qfill I revived it . So I recovered it from missing aboot partition . It must to recover no matter what partition you deleted .I raelly dnt undestand why you had to replece the moatherboard . You did not know about the short pins method?
[G4 General] steadfasterX:
lol.. I'm also aware of the shorten PIN method ;)

without this I wouldnt be able to test all these..! you can blank out all partitions and you're still able to boot into QDL. usually.

The problem was a combination of blowing fuses and flashing only parts of the bootloader.

This way it is not recoverable. No chance. Even when you use medusa box to write directly to the emmc no chance.

sfX
[G4 General] dianxxyyzz:
[/COLOR]

Ok , I understand you now .Maybe I'm too optimist , but using all time the prog_emmc_firehose_8992_lite.mbn from H815_ForFusingDevice folder must not to trigger any qfuses no matter what data you write with qfill .From what I read over forums ,was a old prog_emmc_firehose_8992_lite.mbn witch made qfuses , but the one that is now updated must to NOT make qfuses
[G4 General] ReeS86:
There is a lot of interesting information on the boot process and trustzone on this blog below. If you haven't already come across it you may want to have a look. There are some details about QFUSE that may be useful (way over my head though)

http://bits-please.blogspot.ca/?m=1
[G4 General] steadfasterX:
well as said the qfuses get blown by firmware image flashing (e.g. LGUp + KDZ files) as well. Means when you flash a firmware with an active anti rollback version it will blow your fuses

tell me the md5 of your firehose file please

I have those (they are re-used in several recovery qfil packages):

7db5c4ef68ff36570e87a3ae5809224d

d6123fd88abbf5173c76fc515bca3f04

sfX
[G4 General] dianxxyyzz:
I used this :

7db5c4ef68ff36570e87a3ae5809224d prog_emmc_firehose_8992_lite.mbn

Any way , I will try tomrrow to flash the bootloader from H811 T-Mobile ,inside my H815 to see what happes , I will flash it using TWRP . It it do not boot I just put it in 9008 mode and revive it . When we will find a good H811 T-Mobile boot chain , that works on all G4 , and boots ,and can be oem unlock , will be mission complete . And we are very close .

Any way the safe method to make tests withot to brick your device is to use a unlocked H815 , and flash inside it ALL you want but with dd or with TWRP , not with qfill .

If it will brick , just use qfill and unbrick .