[G4 General] steadfasterX:
Some findings

1. booting a different bootloader stack is possible but it seems to highly depend on the device model!

Example: you can boot with a h812 bootloader stack on a h815 but not a h811 ... but a h810 is able to boot a H811 bootloader stack!

2. Identifying the Anti-Rollback of a KDZ is possible (it was before but only the user autoprime knew how and he didnt published how)

While trying to find out what possible combinations can be done to boot a h811 aboot (where fastboot lives) i found out how we can identify every Anti-Rollback - BEFORE actually flashing a KDZ :p

The Anti-Rollback is stored in the CA certificate within the sbl1 and aboot partitions and named

SW_ID

I checked this on 7 different ROMs for the H811, H815 and LS991 and this matches 100% with the Anti-Rollback value which ppl reported so we can assume its a valid test.

View attachment 4284837 View attachment 4284838 View attachment 4284839

So to identify the Anti-Rollback before flashing you need to just extract the KDZ and DZ and then ghex the aboot.image to find the value of SW_ID. and BAM.. thats all.

I have extended the Anti-Rollback list with some of my findings

3. In theory it is possible to boot another aboot because the following has been tested successfully:

bootloader stack of a H810 plus the aboot and laf (download mode partition) of a LS991 => boots up (sec errors ofc but I can e.g. go into download mode!!)

4. firehose stuff

After identifying a good and an evil firehose (scroll down a bit) I'm using and testing with the "good" one only but after flashing the previously working ls991 bootloader stack with Qfil which gave me an unlocked experience before... this is not the case anymore. the evil firefose will blow a fuse and that fuse seems to be required to be blown so the device get partly unlocked..

UPDATE: 5. QFIL files

Now I'm also able to create QFIL files. You can't find anywhere any useful info how to do this with one exception: the @BigCountry907 method which is incredible complex (sorry dear thats not

you

its just as it is) even when that method is made more usable with using a mega calculation sheet made by him in hours (if not days) of work. He reverse engineered many of that crap and try to get you what is needed at the end.

The solution I found yesterday is incredible easy instead... but it requires leaked qcom files which are taken down due to DMCA and so its hard to find those. Thanks to [MENTION=1258758]ReeS86[/MENTION] I have a copy of that and now can make fully use of the amazing way by [MENTION=6079287]culot[/MENTION] described here: https://xdaforums.com/showpost.php?p=68488903&postcount=5 . Damn thats really awesome stuff!

UPDATE: 6. sdcard unbrick

Now I'm also able to create valid sdcard unbrick images -based on the QFIL files (so no dump of a device needed) which is also something you cant find anywhere.

The method is based on the QFIL files and requires the leaked qcom files as well

UPDATE: 7. weird hard brick

Well I was able to boot, H812 and F500 on the H815 but not H818n(india), H818 (china) and H819. All the tested firmwares were ARB v0 ... but somewhen along this path the device went in a new state which makes it not boot firmwares it had loaded before. The last one tested with success was F500v30, after that i tested H818n -> H819 -> H818 china . None of them booted and after this i cannot boot F500, H815, H812 anymore. Thats REALLY weird as no ARB can be triggered as I use files with ARBv0 only and as I flashed with the infinity box so without QFIL..

Whats next

UPDATE: getting my device working again somehow. I want to avoid the evil firehose as long as possible and currently trying with sdcard unbrick and other methods to bring back the life to my device

after this I still hope to copy the h811 aboot as this would be the perfect approach to get unlocked but .. even when i get that working it may not work on any device so.. maybe using the previous method with the ls991 bootloader stack is the universal method we have to use .