yashsingh1/xdaforums huggingface dataset:
[G4 General] steadfasterX:
no it does not seem like it IS signed ;) 100% and yes of course signature checking (not checksums) is part of the bootloader process. No way to trick that (w/o vulns).

so yes you can NOT change any bit of aboot (again: I know for sure) as the signature becomes invalid.

it is NOT about checksums but about the content(!!) of aboot which is signed. the partition itself does not matter here that's why UsU is "bigger". so you can add zeroes or a mp3 after the actual content and it would still load - as long as you do not touch the actual aboot content.

the boot process of this device is explained in general here: https://lineageos.org/engineering/Qualcomm-Firmware/ --> check 2013-2016 Era

part of the secondary bootloader chain are also other partitions like: tz,hyp,pmic,rpm,sdi and sec

all these mentioned are signed(!) and verified(!) on boot.

the device will reject booting when a signature is not valid (i.e. content of a partition has been modded or if you flash a partition from a complete other device etc) and fallback to the EDL/QDL mode if that happens.

ofc STOCK contains the aboot as the others mentioned. you can use SALT and extract a stock kdz to see whats inside.

even when in QDL/EDL mode the signature is important as the device will reject communicating when your firehose certificate is not valid (ie. it must be signed by a known CA - which are in a write protected area of the PBL) AND also reject when the ARB level is lower then the device has currently.

efuses are triggered only when the device boots. that means (from my xp - and I tested over 1,5 years) you can flash an ARB of 4 on a ARB 0 device without tampering any fuse. but as soon as the bootloader starts his work the fuse will be blown. so as long as the device does not power on no fuse blown (afaik from all my tests).

anyways this leads to nothing useful ig. if you seriously wanna try unlocking you likely need a qcom/LG vulnerability.

... and good news - a user shared this in my TG group: https://douevenknow.us/post/639414006930702336/tying-it-all-together-pwning-to-own-on-lg-phones

I never had the time going into this but maybe you have ;)
[G4 General] emperordogma:
Hello!

I've been working on installing Lineage OS on my LG G4, I seem to have a "Frankenstein" device, it's an H812 (according to Android and Salt), but the Motherboard says it's a H810 or H815 (I'm going to double check that before I actually try to flash anything), and my GPT compatibility is H811 (not sure if that matters much). I unlocked it already with H812 Unlocking, and put TWRP on it, everything seems fine (a little slow to boot up, but I'm not sure if that's normal or anything). My question is, should I flash Lineage OS for a H810 (or whatever my motherboard says) or proceed on with H812?

Thanks!
[G4 General] sdembiske:
The guiding principle is to flash H812 according to your GPT compatibility. If you did not open your phone (disassemble it, unscrewing the fixed back cover and removing it), and actually check what model is stamped on the actual motherboard itself, then use the GPT comatibility as your guide. In my case, when I just look at what is printed on the back cover itself, it reads H810 but is actually an H812 bought directly from my network provider. The back cover is one of the parts LG seemed to use whatever what was available at the time it was assembled. So, if ain't broke, don't try fixing it by flashing any other rom version than what you have, i.e. an H812 (H811).

Do not flash the H810 or H815 unless you want to hard brick your phone and have it as a conversation paperweight.
[G4 General] steadfasterX:
More inportant then the gpt compatibilty is the ARB. If your device has an arb of 0 flashing a ROM for a device with a higher arb will make your phone unusable - forever. So check my signature about arb and what SALT displays about yours.
[G4 General] emperordogma:
I check my ARB through SALT after I flashed the new ROM and everything, and I still have a "0". I think I got pretty lucky with not knowing how to proceed with a Frankenstein device. I do have one dumb question though, I flashed the ROM and whatnot, but forgot to appropriately backup my texts, calls, etc. I have the back up of everything I made through SALT so, my question is, is there a way to revert my H812 "safely" (there's always risks, but I mean no more riskier than before) back to the way it was (I had Marshmallow) so, I can back everything up correctly? I get the feeling the answer is "no", but I can hope. I'm still really new to all this so, I apologize for sounding/being dumb.

I think I got lucky, because when I tried to flash the rom Lineage OS H810, I got "Error 7", I didn't try twice, and went with my original choice of the H812. My motherboard said it was a H810 so, I kept second guessing everything I was doing for fear of bricking.

Also, thank you both for your patience, and time!
[G4 General] steadfasterX:
The arb you see in SALT would not have been increased but another "hidden" one. But h812 was a good choice so yes you are lucky.

You can do that:

Wipe cache (not dalvik) in TWRP.

Using fastboot and flash: boot, system and userdata. Then see what happens. Actually it should work. If fastboot does not allow flashing userdata there is a way doing that in TWRP as well with dd.
[G4 General] sdembiske:
The reason you got lucky was probably due to the 'Assert' line in the updater script in the rom zip file. That line checks that your model is flashing the correct rom version for it. It will throw up error 7 if you flash other than an H812 rom. If you tried to flash an H811 (that is allowed on the H812), you would in all likelihood receive the same error - in that case you would have to remove the 'Assert line' in the rom zip file in order to proceed with the flash, all else assumed equal.
[G4 General] emperordogma:
Would this work the same way if I have a different OS (I have Lineage, I had MM)? I know I already said I did, but I just find it hard to believe it would be that simple considering how risky and complicated everything else was. Also, what's "dd", I've played around in TWRP so, I'm probably just not remembering what that is.

Thanks.

There's no reason for these OS's to be this complicated, I've clean installed windows 2-3 dozen times, why can't a smart phone be similar 😭
[G4 General] steadfasterX:
Yea sorry its thats simple as it sounds ;) now that you're unlocked.. Try fastboot first. dd is a command which you can use in adb shell but lets let this for later
[G4 General] emperordogma:
Just to clarify what I'll have to do, I take a SALT backup of what I have now, then flash the boot, system, and userdata of my SALT "stock" backup, then do whatever it is I do. Should I flash Lineage from scratch or use my SALT backup of it? Sorry for asking so many questions, I want to be as safe as possible doing this, and just in case someone would go looking for this information like I did. And thank you for your time, I really appreciate your assistance in all this, as well as the time you took to make all this possible!
[G4 General] steadfasterX:
I would do a TWRP backup of system,boot and data in TWRP.

Then do a SALT backup of userdata just for the case.

Then revert to stock via fastboot.

When you are done with doing your backup from within stock (you could even root then and use tools like migrate or titanium..) .

Then restore the TWRP backup of LOS.

Keep in mind that when you try to backup apps in stock (e.g. with titanium) and restore them in LOS this often causes problems. The app migrate is a second option if you need to do that. I always use both to be sure one will work..
[G4 General] emperordogma:
What's the difference between a SALT backup and a TWRP backup? If that's too long of an explanation don't worry about it, it's not important, I was just curious. I wasn't even thinking of using things like Titanium, I was more focused on texts and whatnot (I'm usually really good with backing things up too), but I'll have to remember that!

One more thing, I couldn't use FWUL persistent, I had to use a nightly forgetful FWUL, because when I updated SALT it would say it was missing a Crypto python dependency or it would be missing "zstandard" I think it was? I can't remember the names exactly.
[G4 General] emperordogma:
I think I can into a hiccup, all I have are .bin files, and they don't seem to want to flash using fastboot. It doesn't really tell me why, I tried mounting it in SALT, and it won't and just asks if it's a "Mountable image". the logs don't say anything either (aside from that).
[G4 General] steadfasterX:
TWRP will never backup your internal storage (pics, vids, ..) while SALT dumps the whole partition so everything.

FWUL 3.2 is the only supported FWUL version - which does not have persistent mode correct. as you mentioned you used it in persistent mode means you tried on 3.1 or earlier which fails with the mentioned error (and one of the reasons why I made a 3.2).

so either use FWUL 3.2 or mAid 4.0 (the nightly you refer to).

file extensions do not matter in the linux and so android world. if you dont like the extension rename it. e.g from bin to img. but.. as said that does not matter as linux is more intelligent then other OS when it comes to file detection. anyways whats the error? any pics for those? terminal output?
[G4 General] emperordogma:
Sorry about them being images, I don't have the wifi turned on at the moment in mAid.
[G4 General] steadfasterX:
ok @emperordogma -> so the TWRP way..

there are 2 ways to do that. note: userdata will take obviously a looooooong time ;)

try this first:

1. boot TWRP

2. ensure system and data is not mounted

3. exec:

adb push boot.img /dev/block/bootdevice/by-name/boot
adb push system.img /dev/block/bootdevice/by-name/system
adb push userdata.img /dev/block/bootdevice/by-name/userdata
adb shell sync

then try to boot.

if that does not work you need an external sd card. put boot,system and userdata img directly in the root dir of that card.

1. boot TWRP

2. ensure system and data is not mounted

3. exec:

adb shell
dd if=/external_sd/boot.img of=/dev/block/bootdevice/by-name/boot bs=512
dd if=/external_sd/system.img of=/dev/block/bootdevice/by-name/system bs=4096
dd if=/external_sd/userdata.img of=/dev/block/bootdevice/by-name/userdata bs=4096
adb shell sync
[G4 General] emperordogma:
This one worked for me! But unfortunately when I booted it up, it booted up to what I have now, and nothing seemed to have changed. I wiped the Cache (not DALVIK), made sure system and data wasn't mounted, and "pushed" boot, system, and userdata (in the order).
[G4 General] steadfasterX:
ah well .. what TWRP version do you have there?

and which of the 2 did you try? the adb push or dd method?
[G4 General] emperordogma:
I believe it's TWRP 3.4.0, I'm not at my laptop so I'm not 100% sure. And I did the "adb push" method, everything went in fine (from what I could tell. I did "adb she'll sync" at the end as well. I'll try again,maybe I did something wrong because it was 3AM.
[G4 General] steadfasterX:
an outdated TWRP can cause this too. If that that does not work use the dd method.
[G4 General] emperordogma:
I'm going to try the dd method now. I do have one other problem, that I can't seem to find an answer for, my WiFi will not connect, it says "saved" then tries to connect, then goes back to "saved", sometimes showing "disabled", I've tried to fully flash the ROM again, and I even tried the build before it, nothing's worked. Do you know what's causing that?
[G4 General] emperordogma:
@steadfasterX

I got the dd method to work, but the problem is now that I seem to have slightly sorta "bootlooped" my phone (I think), I couldn't get

adb shell sync

to work, it said something like "sbin/sh: adb: not found".
[G4 General] steadfasterX:
without log.. its all just guessing.. there is a logcat guide in my signature (specific issue)

I would guess that you WiFi mac is gone which can be fixed ofc. usually just booting stock once should fix it already. otherwise there are guides. but again thats just guessing without logs.

so whats the current state? it tries to boot stock? you might need to wipe cache (e.g. fastboot format cache or in TWRP). you also should check in TWRP that you can mount the data partition and check in the TWRP browser that you can browse through it (e.g. /data/media/0/ contains your internal storage, i.e Download folder and such)
[G4 General] emperordogma:
I was able to flash LOS and "fix" it, but I figured I'd try again with your new info. I tried clearing the cache after everything was moved over, it boots to the LG screen (assume that's the bootloader I think) and doesn't go from there, even the LED light stays on. I checked if the data partition was all there, and I had to mount it, but aside from that, everything was there (from my "stock" ROM).
[G4 General] emperordogma:
@steadfasterX

--------- beginning of kernel06-25 10:38:09.606 0 0 D [ 9550.856231 / - Pastebin.com

Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.

pastebin.com

Here's the log with my WiFi proglem, it's probably longer than it should be, but it wouldn't clear the logcat, it would return "failed to clear the 'main' log", and my ADB seems to keep giving "sbin/sh: adb: not found" when I tried to pull the log from the phone.
[G4 General] steadfasterX:
Ok the choose "format" data in twrp and try to boot first without your userdata backup into stock. Lemme know if that works.

Re the WiFi pls share also the boot logs (see LOS faq).

Last but but least: Open a new xda thread and lets continue there as this is going too long off topic now. ;)
[G4 General] emperordogma:
Done! Sorry for going off topic like that! 😅
[G4 General] SciHi:
Sir, it is possible to flash files when the device is awake means without going into twrp or something, can we just flash files such as Vulkan API or GPU driver update in the device if the bootloader is locked.
[G4 General] steadfasterX:
your q has nothing to do with this theread. its always better opening a new thread for new questions like this which are not related to anything.

if you modify the system it will fail to boot. so . no you cant. you can do so on Lollipop if you use the same approach as the root flashing method for Lollipop. I cannot help you with that though.
[G4 General] SciHi:
Can you make your usu open source, so that anyone can try to modify it and it can be that someone came up with the solution to unlock h818
[G4 General] steadfasterX:
what source do you miss?

UsU's main part is a leaked proprietary closed-source aboot image.

but everything around it like UsU download mode, rawres etc are part and included in SALT which itself is of course opensource.
[G4 General] aoleary:
The G4 is 6 years old now. I doubt that that's going to happen..

If SFX couldn't get it working for the h818, it wont ever happen..

Buy a h815 motherboard on Aliexpress, if you really want an unlocked phone..

https://a.aliexpress.com/_vbqHip
[G4 General] AndresFrank:
Well, I have an old LG G4 (US991) and a couple years ago I tried to unlock de the bootloader using the steadfasterX method (UsU Method), It worked for a couple of days and then started to reboot every 2hrs aprox, and tried to solve this issue reading and reading threads here in XDA, and I couldn't make it work anymore, then, I bought the phone I have right now, and I totally forgot about this phone, now that I have free time, I decided to tried and fix this phone myself, but in doing so, I bricked even more than already was.

The phone stays in the LG bootloop logo.

When trying to enter the Download Mode, it appears a screen saying "Download Mode" and then restarts.

I tried to conect it to my laptop and entering my devices I saw that it recognizes my phone like "LGE AndroidNet USB Serial Port" and stays there.

I haven't tried the booting with my sd card method, because I want to see if there's a different method.
[G4 General] AndresFrank:
Well, I have an old LG G4 (US991) and a couple years ago I tried to unlock de the bootloader using the steadfasterX method (UsU Method), It worked for a couple of days and then started to reboot every 2hrs aprox, and tried to solve this issue reading and reading threads here in XDA, and I couldn't make it work anymore, then, I bought the phone I have right now, and I totally forgot about this phone, now that I have free time, I decided to tried and fix this phone myself, but in doing so, I bricked even more than already was.

The phone stays in the LG bootloop logo.

When trying to enter the Download Mode, it appears a screen saying "Download Mode" and then restarts

I tried to conect it to my laptop and entering my devices I saw that it recognizes my phone like "LGE AndroidNet USB Serial Port" and stays there

I haven't tried the booting with my sd card method, because I don't have the 9008, so I don't know what else to do.

Sorry for my english, I hope you can understand what I'm trying to say here.
[G4 General] steadfasterX:
The symptoms you describe sounds like the ilapo. Read FAQ 14 for details and possible short working workarounds.
[G4 General] AndresFrank:
Yes, that's what I think man
[G4 General] AndresFrank:
I've read the FAQ 14 and unfotunately nothing is work for me because i dont have any rom or firmware installed, not even the TWRP is working, it goes directly to the LG logo and the blue led keeps "breathing". There's no other way to interect with phone or force to enter to fastboot mode or delete like phisically everything that's in it? Because I see no other way to fix it. Or can I use any of this parts on other phones anything like it?

When I charge it, the image of battery with loading symbol never changes, is like, not even detect the level of the battery althought is charging, and the led keeps "breathing"
[G4 General] steadfasterX:
1. boot into fastboot mode (see OP, topic "changes in behavior")

2. flash the ILAPO twrp into recovery partition

3. boot to recovery

if that fails: repeat the above but on step 2 flash into boot partition instead. now just turning on should boot TWRP allowing you to backup data and erase storage.
[G4 General] AndresFrank:
I've tried several times to enter the fastboot as commented, but i doesn't do anything, it keeps trying boot, and stays there. But I managed to enter the LG recovery mode (the one that only says to do the factory reset) can I do anything from here?
[G4 General] steadfasterX:
no either download mode or fastboot mode are required. ofc you can bridge the debug pins to enforce the 9008 / QDL mode but then you need proper QFIL files to flash + pushing the recovery.img to boot (which itself requires knowledge how to modify the QFIL xml). overall the QDL mode is something where I cannot help much with as I have not much free time for stuff like that atm.

so really try to cool down the device like described in the ilapo thread and boot up download mode. this worked for 2 guys a while ago. 1 had it covered with ice packs around which let it stay in download mode.

- from here you would need SALT (part of mAid)

- doing a backup of just boot partition

- download and place the ilapo twrp in that backup dir

- rename the backuped boot.img to boot.img.orig

- rename the ilapo twrp to "boot.img"

- start SALT in experimental mode

- choose flash folder & flash JUST the boot.img (which actually is the ilapo TWRP as shown in the screenshot

- just let it reboot after that and TWRP should show up

regarding fastboot you might have a broken / not good working button as this should work always. Try pressing the volume button harder or with pressure at slightly different positions. this should really work as this is even more reliable then download mode when it comes to the ilapo

last but not least the factory reset mode you was able to get into is useless - but wait.. when you see THAT you are not unlocked by UsU!
[G4 General] AndresFrank:
I tried to cool down the phone but didn't work for me, it tries to enter to DL mode but after 2 sec it reboots, but i tried to bridge the famous two pins and I managed to enter the 9008 mode, I made the exact files for my G4 but when I try to flash the firmware via QFIL, it says UNABLE TO SEND FIREHOSE NOPDEVICE IS NOT IN FIREHOSE MODE, either way, I'll try to do the SD method and try to bridge de DAT0 and GND to see if it works, I think that's the only alternative I have right now.

My phone:

Doesn't enter fastboot in any way

Doesn't enter Download mode in any way

I can enter to the LG recovery mode

It stays in the logo and the blue led "breathing"

It can enter the 9008 mode, but, it says that the phone is not in the FireHose mode (Is not a firmware issue bc I literally made a rawprogram.xml and patch.xml specifically for my phone using an official KDZ fom LG and using the 8992.mbn file)

Cool it down didn't work for me

Iron it down didn't work for me
[G4 General] LukeSlovian:
Hello please Help Me. How to install Salt applications on Kali Linux? What is the guide for this?
[G4 General] Radoslav 1608:
Hello Dear Friend Community XDA. Please Reply Me Question. Ho to install Salt Apps / Tools ins Kali Linux OS system Me Laptop ? Friend SteadFasterX do You send me Tutorial Steap By Steap Install Salt Apps/ Tools in Kali Linux OS system Me Laptop ?
[G4 General] steadfasterX:
No. This thread is about UsU not about SALT. SALT has an own thread where it is explained how to install.
[G4 General] LukeSlovian:
Please send me a link to the thread about the Salt Application in response.

Configuration and startup for Kali Linux Debian OS.
[G4 General] Radoslav 1608:
Give me a link to a thread where I can write a help request about Salt.
[G4 General] wesside298:
hello..gretting from las vegas...@steadfaster..i have an lg h918 here..if you are still wanting it ..lol i know its been awhile..but i will ship to you..if youd like..np..l.m.k..thx bud
[G4 General] hteles:
Network problem workaround: it works if you reboot several times ( usually two ) until SIM get detected. AOSCP Oreo with my h815 refurbished eBay phone...
[G4 General] mwahahaa:
How large is the modem file for h812?. Can someone share it? I originally did a SALT backup but lost It after reformatting the usb to install newer FWUL.
[G4 General] slim902:
Thanks alot, it seems to have worked.
[G4 General] hey_joe:
It's about 73 Mb.

Edit: Tried uploading but seems too big for xda to host. Where would be the best place to upload it?

Edit2: http://www106.zippyshare.com/v/G4bKe4B5/file.html
[G4 General] slim902:
[MENTION=5545101]steadfasterX[/MENTION]

Here are the logcat dumps:

While trying to play music in Shuttle music play. (Sound not working) : https://bpaste.net/show/f8efc3d2aa3b

After flashing modem.bin from my salt backup (I had no cell service here) : https://bpaste.net/show/bab17e561ef6

After a reboot, with cell service again, playing a video in youtube: https://bpaste.net/show/c822d1ec18a3

Hope that helps.

Edit: Lost cell service after another reboot.

Edit2: Flashed H812_UsU_baseband_flash-in-twrp.zip again and now seem to keep cell service on every reboot instead of every other reboot.
[G4 General] අධිරාජ (Adhirāja):
Ok
[G4 General] Vasto_lorde97:
What rom could i flash on a sprint g4 thats nougat or oreo?
[G4 General] spartan268:
I noticed that as well. After one or two reboots it catches on. I did notice some flickers where it lost connection while I'm using my phone but I couldn't tell if it was a complete loss or just my LTE dropping down a notch. For the time being im satisfied and the video thing I can sort of love with for now.
[G4 General] fates13:
Another weird issue is that the stock 29A rom won't boot on VS986. Flashed the ROM then reboot doesn't work and flashing rom then full lollipop modem doesn't work. I can still boot Lineage Nougat by flashing rom then full modem but security and calls still don't work. APN settings are completely wrong like I mentioned, only LTE internet works.
[G4 General] nummer:
[you never saw this]
[G4 General] calvavet:
Another flawless bootloader unlock, TWRP install and root with magisk on H815T. Android N v29a plus viper4android flawless installation too.

Only problem so far but I think it's a known issue: TWRP rom backup is impossible.

Thank you so much. :good::good::good: