yashsingh1/xdaforums huggingface dataset:
[LG V20 Guides, News, & Discussion] runningnak3d:
OK, so I was sent yet another site that didn't require the unlock to be done remotely. You install an app with your SIM card out, and put the code they send into their app. It does some magic, and viola, it did SIM unlock the phone.

So, I have network dumps that I have to go through, and I have a full dump of my phone before and immediately after unlocking.

This is definitely not at the top of my priority list, but since it CAN be done, I CAN replicate it. It is my guess just by a quick glance at this packet capture that the "code" that they give has nothing to do with the unlock procedure except as a "you paid for the service, here is your code" to prevent you from sharing the service with others.

They also compiled the APK in debug mode, so it isn't exactly going to be hard to read...

-- Brian
[LG V20 Guides, News, & Discussion] b8engl:
You see how it was possible! No need to use the TMO app.

I agree with you on this! The key is signed on there side, no way to get around this.
[LG V20 Guides, News, & Discussion] yelnam2manley:
What service is this? I'm interested on trying this out.

---------- Post added at 09:21 AM ---------- Previous post was at 09:20 AM ----------

What service was it [MENTION=3167089]runningnak3d[/MENTION]? I'm interested on trying it out as well.
[LG V20 Guides, News, & Discussion] Stallio:
My problem is that The mobile app doesn't do anything and gives error as per the URLs. Now I don't even get any option to put in those Paid codes.

[IMG="T mobile error while unlocking"]http://postimg.cc/image/4mb6jeob5/[/IMG]

[IMG="Error While Trying to unlock Lg v20 H918 Tmobile"]http://postimg.cc/image/vk53lcyq9/[/IMG]

I hope from the unlock code you've got the general Idea that there are possibilities of unlocking this device.

Curious what you will dig out of that code.
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=7795754]Stallio[/MENTION] I am not talking about the official TMO app. The service I used has their own app that talks to their servers.

Speaking of which, it looks like I was correct. They take your IMEI, and somehow get TMO to send THEM the key, and then their app installs it just like the TMO app does. So the piece that is missing is still locked away in their servers since the communication between them and TMO couldn't be captured.

But again, knowing it can be done, I will eventually replicate it, but when I do, you can bet TMO will patch their servers.

-- Brian
[LG V20 Guides, News, & Discussion] jimenezboy:
There's someone in this very forum who unlocked my H918 in January this year. The phone was ineligible for unlocking using the T-Mobile Unlock App. He did something that made it eligible, after which I permanently unlocked it.
[LG V20 Guides, News, & Discussion] Metconnect2000:
Hi, I would like to do something similar. Currently I'm on superrom rooted h918. The TMobile unlock app would not proceed, just doing circles. If I understand you correctly, I can flash the stock rom in twrp and boot it up to unlock the phone using the TMobile unlock app, which I'm eligible to unlock. And then boot into twrp ( assuming it doesn't get wiped out,) , reflash super rom and root. Do you have any experience with super rom? Would you think the unlock would remain? Thanks.
[LG V20 Guides, News, & Discussion] yelnam2manley:
I was able to unlock my H918 using a service on eBay. They teamviewer-ed into my computer, installed Flexihub (which allowed their smart card reader to connect to my computer to authenticate their software), and LG 2-3G Tool (which unlocked my phone).

Before I got it unlocked, I used Patched LGUP to dump every single partition from the phone (except boot, cache, system, and userdata) to a folder called LOCKED. Once the unlock was done, I dumped again to a folder called UNLOCKED.

Then I started mucking around with the modemst1 and modemst2 partitions, as it's related to the modem. I took the dumped modemst1 and modemst2 files (from LOCKED folder)), flashed it on modemst1 and modemst2, and it SIM relocked my phone. Then I repeated the same steps but I flashed the files from the UNLOCKED folder, and it sure enough, it unlocked phone again.

While the phone was locked, I used QPST to dump the NVRAM to a QCN file. After the phone was unlocked again, I repeated the same steps.

If anyone wants those files (I don't care about the IMEI as It's blacklisted in the US anyway), I'm happy to supply. I'm also willing to supply all of the dumped modemst1 and modemst2 files.

Just for the hell of it, in TWRP Terminal, I zeroed both modemst1 and modemst2 partitions by typing "dd if=/dev/zero of=/dev/block/sdf1" and "dd if=/dev/zero of=/dev/block/sdf2". My IMEI didn't change, but it did relock the phone. I flashed the dumped files from the UNLOCKED folder and I was able to unlock. Perhaps, if you can backup your modemst1 and modemst2 partitions, you could flash the files that I'll supply, and see if that's enough to unlock your phone.
[LG V20 Guides, News, & Discussion] b8engl:
Yes, please share those files to [MENTION=3167089]runningnak3d[/MENTION]
[LG V20 Guides, News, & Discussion] yelnam2manley:
As soon as he replies that he wants them. I'll send it to him.
[LG V20 Guides, News, & Discussion] cnjax:
There's no way I'd give them access to my pc let alone install software on it. Js
[LG V20 Guides, News, & Discussion] runningnak3d:
Absolutely! Please zip them all up and PM me a link. It makes it a LOT easier to find a pattern when you have multiple sets of before / after to compare.

Thanks,

-- Brian
[LG V20 Guides, News, & Discussion] yelnam2manley:
You could use a virtual machine. If you have an extra hard drive/SSD. Install Windows on that and give them access. Or just use a spare computer.
[LG V20 Guides, News, & Discussion] yelnam2manley:
Here you go.

This contains the dump of modemst1 and modem st2 (both before and after the unlock), and it has both the QCN dumped when the phone was lock, and unlocked.
[LG V20 Guides, News, & Discussion] runningnak3d:
So, my modemst1 and st2 that are from my unlocked dump are identical to yours. It appears they just take a generic image and flash it.

So, anyone that wants an unlocked phone, feel free to backup modemst1 and modemst2 (just in case there are any side affects) and flash the ones from [MENTION=3659647]yelnam2manley[/MENTION]'s zip file....

Let us know what the results are. I did test flashing my modemst1 and st2 before the unlock, and it does SIM lock it again, and I flashed his modemst1 and st2 from before the unlock and I was SIM locked, but my IMEI did not change, and I was able to make calls.

-- Brian
[LG V20 Guides, News, & Discussion] askermk2000:
Hey Brian

I didn't know you started this thread until now. Great initiative! Got a few things cleared up.

So it seems all of tmo app stuff is just to be able to write to the encrypted efs/nvitems ?

I assume the relevant nvitem is locked from writing through qpst or such.

Nice to know I can flash those modem files to unlock my H918 if the opportunity arises.
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=6814590]askermk2000[/MENTION] Hey dude, long time no talk (type) :)

Yea, I still don't fully understand the unlock process, as in what the modem firmware is actually looking for. I just know that the files that [MENTION=3659647]yelnam2manley[/MENTION] sent after his phone was unlocked, match mine byte for byte.

I have never bothered to look at exactly where the IMEI is stored (besides misc). I thought for sure it was in modemst1 and/or 2 as well. I still need to compare the before / after dumps to see if writing the ENTIRE modemstX partitions are actually needed, but for now, as long as someone backs up theirs, this will unlock -- can sort the rest out later ;)

Glad to know you are still around!

-- Brian
[LG V20 Guides, News, & Discussion] askermk2000:
Well this is a bit strange.

Yes, the modemstX partitions store the imei. So why didn't it change when flashing this (probably) dump from another phone?

Or maybe it's stored in fsg... The modemstX and fsg partitions are involved with the efs. Though I'm not very knowledgeable about the details.

As I understand it, the efs/nvitems are stored in those partitions encrypted. When you use qpst you get access to a portion of this system, which you can manipulate, and then the qualcomm security mechanisms properly encrypts the changes back.

Usually you can't simply load qpst to get access, there is a workaround that works for lg phones, and it's to delete modemstX and fsg. Then you'll be able to upload a backup qcn-file (which you'll have edited).

I changed my imei this way one time. But I never tried to simply flash a pair of files from a different phone.

So it seems either fsg partition holds the imei, or there is some additional stuff going on when qualcomm mechanisms process and integrates the qcn/nvitems backup.

[MENTION=3167089]runningnak3d[/MENTION], Yes I'm still here. Not planning on buying another phone anytime soon. Also I started on upcoming msm8996 Oreo kernel, it's already up on github: mk2000-oreo.

Though seems I may take a while until I get Oreo on my G5, so I'll wont be able to do tests.
[LG V20 Guides, News, & Discussion] yelnam2manley:
Since I already have the partitions backed up.. I'll try and wipe the misc or fsg partition and see what happens.
[LG V20 Guides, News, & Discussion] runningnak3d:
Aye - I am digging now, and it looks like fsg or fsc are the partitions that actually contain the IMEI. If wiping fsg allowed you to upload a modified QCN and changed your IMEI, then I am going to go with fsg ;)

When the modem firmware loads, it reads: modem_fs1, modem_fs2, modem_fsg, modem_fsc (which the partition mappings should be obvious).

It also read several values from the misc partition, although those don't appear to actually be used for much other than some kind of verification. Obviously if you wipe your misc partition, your phone still works, so that kind of backs that up.

I am not going to waste too much time on understanding the WHY this works yet -- got much more important things to works on.

I will eventually circle back to this to fully understand, end to end, how the modem firmware works (especially unlocking).

-- Brian
[LG V20 Guides, News, & Discussion] ki11aprime:
Would i have to be on stock to do this or any stock base rom should work?
[LG V20 Guides, News, & Discussion] runningnak3d:
Stock, or Lineage -- it doesn't matter. This is read by the modem firmware.

-- Brian
[LG V20 Guides, News, & Discussion] ki11aprime:
i tried it and it didnt work for me followed the instruction in the zip
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=3659647]yelnam2manley[/MENTION] Can you dump your fsg and fsc partitions and send them over as well?

-- Brian
[LG V20 Guides, News, & Discussion] ki11aprime:
[MENTION=3167089]runningnak3d[/MENTION] what is the qcn file that is included in the zip.??

would that be his IMEI
[LG V20 Guides, News, & Discussion] BROKEN1981:
He/she may have used a VM, if that's the case, then nothing to worry about.
[LG V20 Guides, News, & Discussion] VelosterM14:
Question about these - I have been reading up on V20 topics since I am buying 2-3 of these to replace my wife and my phones - Does it matter which version/security patch level your phone had on it when you got these st's? I saw another thread talking about modem st's and needing to be careful not to flash an ARB0 st onto a device that is ARB1 and vice-versa. If it is important could you share what patch level these st's came from?

Sorry for the noobish questions. Wife and I have been on VZW since 2014 with our VZW nazified devices but with our contract up and timing being right otherwise, we are planning to dump VZW and bring some H918's to T-Mobile -- and I intend to unlock and root our H918's when we get them. So I am having to educate myself on LG and T-Mobile specifics. I've been around the rooting block several times with Moto and Samsung devices but am new to LG, so trying to be careful.

Thanks!

VelosterM14
[LG V20 Guides, News, & Discussion] runningnak3d:
EFS isn't signed, and therefore no ARB version (modemst1, modemst2, fsc, fsg). The modem firmware IS signed, and has an ARB version (modem).

As long as you have a backup of your EFS, you can flash modemst1 and 2, fsc, and fsg from any model, on any firmware, and any ARB version. Now, that isn't to say that your phone will WORK, but you aren't going to brick it by playing with those. I would suggest getting a copy of QPST if you would like to edit your EFS (again, AFTER making a backup). EFS isn't encrypted, but it is encoded -- so you can't just take a hex editor unfortunately.

-- Brian
[LG V20 Guides, News, & Discussion] wolfy:
Duplicate post
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=242084]wolfy[/MENTION] Yes, your IMEI is in EFS, but I need dumps of all 4 EFS partitions, and misc, persist, and persistent.

If you zip them up and PM me a link, you can rest assured I have no intentions of sharing them or doing anything other than analysis.

If you would do it on your unlocked phone, and a before and after of your locked phone, that would really help the cause.

If you are worried about the IMEI, I totally understand.

-- Brian
[LG V20 Guides, News, & Discussion] Stallio:
Wow, we are running for same, I think that person is not in this room or else he would have shared his technique with us. It will be great if yiu remember who was he/ she we will ask them to share it with us.

Thanks
[LG V20 Guides, News, & Discussion] sansara_2001:
Hey.

I have x872 with root rights. and there is an octoplus box. I can take the necessary data for you. the phone for some reason can not be unlocked via the octoplus box at the stage of sending data to the unlock server. now the phone works on the network using a temporary unlock from the t-mobile. what points from the screenshot are you interested in?
[LG V20 Guides, News, & Discussion] nimbus22:
I just got an H918 and downloaded the files. Some noob questions.

- Does the phone need to be rooted first?

- Does the ROM/Firmware need to be a specific version?

- Once unlocked will it stay that way even if I upgrade or change roms in the future?

It would be helpful if we could get a writeup with more details on the process. Thanks.
[LG V20 Guides, News, & Discussion] runningnak3d:
There is no process yet because it still isn't fully understood WHAT gets changed.

I need more dumps of the full EFS from before / after unlocking (modemst1 and 2, fsc and fsg). Right now, I only have mine, and you can't find a pattern in one dump :)

-- Brian
[LG V20 Guides, News, & Discussion] Stallio:
[MENTION=3167089]runningnak3d[/MENTION] I need your suggestion, as I discussed earlier here in this post that I am sending my phone to get it fixed, now the seller is saying he will take 3+ months to send me back as he will first send it to Hong Kong (Seems a big baloni to me) and now I am getting impatient. Should I ask him to send me my phone back and get it unlocked online the way you did it? Forgive my noobness' just guide me a bit about all the tools required to take the image/EFS before getting unlock and after getting unlocked So I can share it with you 'as you said that you need more EFS. Everyone will be happy. What do you say?
[LG V20 Guides, News, & Discussion] BAFLGV20:
You can use the laf recovery method in the H918 noobroot thread.

as long as TWRP is still accessible.

https://xdaforums.com/v20/how-to/guide-h918-restore-laf-partition-t3804728
[LG V20 Guides, News, & Discussion] yelnam2manley:
Sorry for the late reply. Here are the fsc and fsg partitions.

I no longer have this phone, but still has the fsg/fsc partitions when before and after I unlocked it.. So, I won't be contributing any further.
[LG V20 Guides, News, & Discussion] supercommanderz:
I'm also dump every partition before sim-unlock my LS997.

Here are the different partitions from sim-locked/sim-unlocked LG V20 LS997AVZ (arb1)

http$://mega.nz/#!tg9iHAjb!mstTn-4vJ9DMH2DImCY9m9qeO9uzShL0LCjXOjgA_qE
[LG V20 Guides, News, & Discussion] Stallio:
The software which was used is LG 2 -3G Tool, I will try to download this app and try to do it my own though haven't received my phone from seller yet, I'll ask him to send me back if he can't fix it. I will see it the cracked version works if this software fixes my issue I'll buy it. Don't like the runaround given by devs).

I have highlighted the things I have confusions with starting with QPST to dump the NVRAM to a QCN file how it is done with qpst...... I have QPST don't mind it's bid of language barrier that I couldn't got how you performed it.

Second - in TWRP Terminal, I zeroed both modemst1 and modemst2 partitions by typing "dd if=/dev/zero of=/dev/block/sdf1" and "dd if=/dev/zero of=/dev/block/sdf2[/COLOR]". Can this be done without command line? As I don't know any computer language.

All noob questions, members please guide a bit.
[LG V20 Guides, News, & Discussion] Grin59:
I would like to try this if it wouldn't mess up my phone.
[LG V20 Guides, News, & Discussion] jawwad_shaukat:
Hi, kindly resend this file :

LG_V20_modemst1_modemst2_qcn.zip

the link is giving "410 Gone" message..
[LG V20 Guides, News, & Discussion] skurtov:
I'm a little curious why you just can't get the SIM unlock code from T-Mobile support and just jam a new sim card in. Wait for the prompt and use the pin
[LG V20 Guides, News, & Discussion] runningnak3d:
Because TMO doesn't use a PIN, they use this stupid app which requires you to be a TMO customer.

-- Brian
[LG V20 Guides, News, & Discussion] Grin59:
I believe you have to be a T-mobile customer and use the app, or you can try and replace the partitions that have the SIM lock that are in this thread.

For me personally, I'm not sim unlocked but I can use a Family Mobile sim card which runs on the T-mobile network, so maybe it could also apply for whatever other TMO ran network. Anyways, I'd recommend FM since their lowest pre paid plan is $25 dollars.
[LG V20 Guides, News, & Discussion] skurtov:
Well as long as the phone is not being paid for you should be able to force them to give you the unlock pin.
[LG V20 Guides, News, & Discussion] Grin59:
I doubt it. One, you have to have it activated for however months, and on the H918 you have to use the unlock app, which will check how long the phone has been activated
[LG V20 Guides, News, & Discussion] DeepSlackerJazz:
No luck here; however, I flashed in download mode (recovery) - I do not know if the SOC will let you write those partitions in that mode. MD5 sums do not match any files, in the zip or my dump, after writing.

Network still works, however. I suspect that a modem upgrade "found its way" on to the unlocked phone alongside an efs/fsg update.
[LG V20 Guides, News, & Discussion] asialove2013:
Hello again

is NVM backup useful?

If it is possible to get a backup of NVRAM from an unlocked phone and then write back ?

I can use LGUP to dump the NV items, but do not know which item is related to SIM lock.

I am using a hex to open HK30b_COM4.nvs - which is dumped by LGUP. and trying to find out if it has any information about SIM LOCK.
[LG V20 Guides, News, & Discussion] GSM-Drone:
cool but it actually send 2 requests to tmob server

1. with imei

2 with imsi (once u try to push unlock button)

If change imei by using any MITM tools it wont work as this will brake the signature. I used Frida to inject new imei into the unlock app request on the fly.

____

/ _ | Frida 12.1.1 - A world-class dynamic instrumentation toolkit

| (_| |

> _ | Commands:

/_/ |_| help -> Displays the help system

. . . . object? -> Display information about 'object'

. . . . exit/quit -> Exit

. . . .

. . . . More info at

Spawned `com.tmobile.simlock`. Resuming main thread!

[Samsung SM-G386T::com.tmobile.simlock]-> hook start...

Called - deviceID()

3528290656XXXXX

and the reply is "Server not responding. Please try again later"

The send request to server send IMSI only. And I am able to hook it using Frida. But this wont work as the unlock eligibility results or device flags got during the 1st server request.
[LG V20 Guides, News, & Discussion] cnjax:
Discussions on changing imei on xda is a no no
[LG V20 Guides, News, & Discussion] stewie-droid:
[MENTION=8639605]Phoenix591[/MENTION] H918-sim-unlock.zip does this still work on unlocking sim card to all carriers, especially global?

https://androidfilehost.com/?fid=11410963190603886898

Do i still need t-mobile code for this?

How to i check if my sim card is unlocked after i run this zip?

Thank you.
[LG V20 Guides, News, & Discussion] BaCkkk:
buddy i tried to flash modemstX partitions by twrp and by zip file too but same network lock..is there is something im missing?thnx
[LG V20 Guides, News, & Discussion] cnjax:
Don't know why you're quoting me and that post. As to unlocking the H918, there have been numerous discussions about it and I believe you have to go through t-mobile to unlock or used a paid service ymmv
[LG V20 Guides, News, & Discussion] Grin59:
Can anyone confirm flashing these partitions will sim unlock your phone?

I'm going to try and back up EFS in twrp, and flashing these. Hopefully it'll work, and then if can be a reference to anyone else who needs help

---------- Post added at 07:59 PM ---------- Previous post was at 07:49 PM ----------

I'm going to follow this first since you're saying it does work
[LG V20 Guides, News, & Discussion] crumbling9999:
If you'd just read the thread, there are other people that already confirmed it doesn't work. The changes done to the device is unique to that device, only way to unlock is through T-Mobile directly, or through a third-party service that either has backdoor access to T-Mobile's server/tool, or somehow reverse engineered the process. The V30 forum had a successful case of the latter, the device was even financed and uneligible for unlock until its paid for, and the 3rd party tool doesn't even directly support it, a build.prop change was used to trick it into thinking its a G6.

Brian's H918 was also unlocked previously using a 3rd party service, so its not exactly a clean testbed either. Note that the modemst dump from both unlocked phones are identical, which means the device-specific file is dropped elsewhere. There was also a case where the unlock was lost after sending out the phone to repair, and the phone was left in a limbo state where not even T-Mobile could unlock it (app thinks its already unlocked, which means it see the key in place already). It was eventually fixed by using the SVC Menu's Factory Reset function, which wipes the mystery partition containing the unlock "key", allowing the T-Mobile app to work again
[LG V20 Guides, News, & Discussion] Grin59:
Well looks like I gotta find a 3rd party service then
[LG V20 Guides, News, & Discussion] Stallio:
Were you able to get your phone SIM unlocked?
[LG V20 Guides, News, & Discussion] Stallio:
I would be grateful if you will elaborate bit more on the quoted underline steps, I am unable to figure it out how you did it. I have installed both the software your bit more guidance is required.
[LG V20 Guides, News, & Discussion] Grin59:
No, only one I found was 80 dollars for T-Mobile. Haven't tried ebay

---------- Post added at 05:45 PM ---------- Previous post was at 05:44 PM ----------

"

"
[LG V20 Guides, News, & Discussion] Stallio:
Commands in Instruction does not work

The instruction in the zipp:-

adb shell

su

dd if=/sdcard/modemst1_locked.img of=/dev/block/sdf1

dd if=/sdcard/modemst2_locked.img of=/dev/block/sdf2

reboot

These commands does not work other ADB commands work I am On H918p version.

I am using minimal ADB
[LG V20 Guides, News, & Discussion] 244631232:
I am in china, I konw chinese-second hand seller can unlock sim lock for 100yuan(about 15 dollar), it's amazing that they don't need to dismantle machine.