[LG V20 ROMs, Kernels, Recoveries, & Other Developm] Cryovenom:
Hi All,

With the recent launch of LineageOS 18.1 I decided to take the plunge and get it installed on my fully stock Videotron/Freedom H915. Since I had to smash together info from a half dozen other threads, I figured I'd gather it all together here for folks with a Canadian phone trying to make this work.

Since I knew absolutely nothing coming into this, I'm going to go a little more detailed on this write-up. If you've been flashing ROMs since the old days of Cyanogenmod you can probably skim half of this.

Disclaimer : I'm not responsible for any bricked phones or other negative outcomes. This is what worked for me, but I'm far from being an expert. If you continue past this point you agree to take your time, do your reading, be responsible for your own device/actions and not hold me or the forum accountable for anything that might go wrong. You've been warned.

IMPORTANT NOTE #1

If you've picked up an H915 on ebay and you are intending to use it on a network other than the one it's SIM locked on, make sure you do the whole SIM unlock process on the stock ROM either before you get started at all, or once you've reverted to the vulnerable stock ROM after Step 1 below.

I actually use Telus as my provider and I wasted a bunch of time trying to figure out why I couldn't get signal because only the stock ROM will prompt you for a SIM Unlock code. Lineage will just sit there dumbly and not allow you to enable data.

Once you've unlocked the SIM it will stay unlocked from that point forward, just make sure to unlock it and verify your SIM is working with LTE on the stock ROM before you get started.

IMPORTANT NOTE #2

Use LGUP's "DUMP" feature to take a backup of ALL partitions on your phone before you start. If you're reading this thinking "I just bought this phone off ebay, there's nothing on it I care about", take the backup anyway. You never know when you might need a copy of the modem partitions or other things from your phone's original build. It came in super handy for me in troubleshooting the process. So go do a backup!

Current Issues:

If signal is too weak to connect to a tower (or non-existent), the OS tends to crash with a modem error. Still trying to figure this one out.

I think I can get this working without first jumping to US996 but haven't had a chance to verify that. If I do I'll update the thread.

Download Prerequisites

Links working as of 2021-06-29

LGUP with patch

Link

Working adb/fastboot environment

Instructions

Download

Fastboot Drivers

Link

Universal ADB Driver

Link

Videotron/Freedom H915 Android 7 (Nougat) version E - H91510e_00_VTR_CA_OP_1205.kdz

Link

USA General US996 Android 7 (Nougat) version F - US99610f_00_1205.kdz

Link

APK for Terminal Emulator

Link or Alternate Link

LG V20 Root Package Original (v4?)

Link

Old TWRP for Root Package

Link

Videotron/Freedom H915 Modem Partition Image

Link

Lineage Install Zip for H910 (grab the latest, I'm using lineage-18.1-20210506-nightly-h910-signed.zip which is already out of date)

Link

MindTheGapps

Link

(Optional, for rooting) Magisk

Link

Different Boot Modes

For those not familiar with these phones, there are three different "modes" the phone can boot into. Here's a quick reference on how to boot into each one.

Download Mode

This mode is used for pushing KDZ files or individual partition backups using LGUP

Turn Off Phone

Hold the Up-Volume Button

Insert USB-C Cable with other end already plugged into PC

Bootloader (aka Fastboot) Mode

The H915 doesn't come with this mode by default. If you try it, you'll just get battery charging. We'll be temporarily converting the phone to a US996 in order to use the DirtySanta exploit to replace the bootloader partition with a leaked Engineering aboot.

This mode is used with the fastboot tool to load the TWRP utility into the Recovery partition.

Turn Off Phone

Hold the Down-Volume Button

Insert USB-C Cable with other end already plugged into PC

Recovery Mode

The recovery mode on a stock phone is used to perform a factory reset. We will be using the Factory Reset a couple times with the stock ROMs, then replacing the contents of the recovery partition with the TWRP tool that allows us to format partitions, load partition images, and sideload apps and LineageOS itself.

Turn Off Phone

Hold the Down-Volume Button

Press and hold Power-On (rear fingerprint sensor/button). When LG Logo appears, release power button for 1 second then press and hold again

When "Factory Data Reset" appears, release all buttons

Press Volume Down to highlight "Yes" then press power button to select the option

Repeat for the confirmation

Note about flashing KDZ files using LGUP

You can flash KDZ files onto the phone using LGUP from two places - either with the phone in "Download Mode", or with the phone booted into the OS with the USB Options set to "File Transfer" and USB Debugging turned on.

The difference between these two is when it performs the OS compatibility check.

In Download Mode it's the code of the Download Mode partition that does the check. In the OS, it's the OS that does the check before booting to Download Mode and bypassing Download Mode's check.

Why is this important? Because when converting from one phone to another (Say, an H915 to a US996 like we do below), you initially can't flash the KDZ using LGUP's "Upgrade" function. You can only use "Partition DL" to replace the contents of partitions with the contents of the KDZ. This kind of works, but ends up with a phone that will sometimes identify as a H915 (in Download Mode) but sometimes identify as a US996 (in the OS). To clean it up, once you've done the Partition DL method, you can do it again from the OS and use the Upgrade method to get a really clean install.

It works going back the other way as well when you want to return to stock.

If this doesn't make sense, don't worry. You don't need to fully understand it to follow the instructions below, I just found it to be interesting info that didn't seem to appear in other threads.

Process Overview

Revert the phone to an old/vulnerable stock Nougat ROM for Videotron/Freedom Mobile

Enable Dev Options

Dump contents of US996 KDZ partitions over top of existing partitions

Cleanup by re-flashing US996 KDZ partitions over top of existing partitions

Transfer files to the SDCard and install Terminal Emulator

Unlock the Bootloader using the DirtySanta exploit

Boot to old TWRP and install new TWRP

Boot to new TWRP, install LineageOS, Google Apps, and flash modem partition image

Reboot to LineageOS

Actual Process

1 - Revert the phone to an old/vulnerable stock Nougat ROM for Videotron/Freedom Mobile

We need to be on Nougat for this to work, so if you're on Oreo you have to downgrade to Nougat before we begin. I chose a Nougat ROM for the H915 that's vulnerable to the DirtySanta exploit because I know it works and because I'm hoping in the future to be able to skip converting the phone to a US996 if possible.

Boot phone into Download Mode

Launch LGUP with Patch

Select "Upgrade" radio button

Select bin file : H91510e_00_VTR_CA_OP_1205.kdz

Click Start

When finished phone will reboot

1.5 - Do this if Step 1 Failed... Otherwise continue to Step 2

Depending on what's loaded on your phone when you start, it might complain about doing Step 1. This should allow us to bypass the issue and allow Step 1 to work. You can use this step if you've already converted the phone to another model as long as it's not bricked.

Boot phone into download mode

Launch LGIP with Patch

Select "PartitionDL" radio button

Select bin file : H91510e_00_VTR_CA_OP_1205.kdz

Click Start

Click the "Select All" partitions checkbox and click OK. When done it will reboot.

If it hangs or loops on reboot, boot into "Recovery Mode" (which at this point will Factory Reset the OS)

The phone boots into the OS

Quickly go through setup wizard. Skip as many things as possible.

Go Settings - General - About Phone - Software Info - Make sure it identifies as H91510e

Change the USB Option mode to "File Transfer"

Then repeat Step 1, but from inside the OS instead of in Download Mode

2 - Enable Dev Options and File Transfer Mode

We need these enabled after every time we flash the OS so that our LGUP and adb commands will work. You'll get used to doing these steps a bunch.

Quickly go through setup wizard. Skip as many things as possible.

Unplug USB-C cable

Swipe down from the top and change from USB Charging mode to File Transfer mode

Settings - General - About Phone - Software Info

Tap on Build Number many times until it unlocks Developer Mode

Go back 2 menus and enter the new "Developer Options" menus

Make sure "Enable OEM Unlock" is enabled

Enable "USB Debugging" (will be greyed out if USB-C cable is still attached)

Go back to main screen

Plug USB-C cable back in.

A pop-up will appear asking to Allow USB Debugging. Check the "Always Allow" box and tap OK

3 - Dump contents of US996 KDZ partitions over top of existing partition

The Videotron/Freedom KDZ has no Bootloader/Fastboot mode. If you try to enter bootloader mode you'll just end up charging the battery. So we have to cross-flash the US996 KDZ to get a phone with a bootloader which we can then replace with the engineering version using the DirtySanta exploit.

Boot phone into download mode

Launch LGUP with Patch

Select "PartitionDL" radio button

Select bin file : US99610f_00_1205.kdz

Click Start

Click the "Select All" partitions checkbox and click OK

When the phone boots back into the OS, repeat all of Step 2.

Note: If it asks for a password on startup, follow the "Boot to Recovery" steps and since

we don't have anything loaded in the recovery partition it will wipe/erase the phone

and remove the password.

4 - Cleanup by re-flashing US996 KDZ partitions over top of existing partitions

As mentioned in the "Note about flashing KDZ files using LGUP" section above, after you use the PartitionDL method you get a kind of dirty phone image that doesn't always identify as its new model. To clean up, we repeat the process in Upgrade Mode, taking advantage of the fact that at least the OS now identifies as US996 even if Download Mode doesn't. After this, Download Mode will also identify as US996.

Starting booted into the OS with a USB-C cable attached (File Transfer mode, USB Debugging on):

Launch LGUP with Patch

Select "Upgrade" radio button

Select bin file : US99610f_00_1205.kdz

Click Start

When the phone boots back into the OS, repeat all of Step 2.

5 - Transfer files to the SDCard and install Terminal Emulator

We will need some files on the SDCard in the phone in order to install them, either inside the OS (in the case of Terminal Emulator), or later on from TWRP. The Terminal Emulator will be used for the DirtySanta exploit so we need to get that installed now.

Make sure the USB Connection is set to Data Transfer mode and copy the following files to the SDCard:

APK for Terminal Emulator

twrp-3.5.1_9-0-us996.img

h915freedommobilemodem.img

Enable installing apps from unknown sources by:

Settings - General - Fingerprints and Security - Unknown sources (turn it On)

Install Terminal Emulator:

Tools - File Manager

Choose "Allow" when prompted

Click the up-arrow next to "Internal Storage"

Choose SD Card

Scroll down and tap on jackpal.androidterm-1.0.70-71-minAPI4.apk

Install

6 - Unlock the Bootloader using the DirtySanta exploit

The US996 KDZ has a bootloader but it's locked. In order to unlock it we need to use the DirtySanta exploit to give us permissions to replace the Bootloader/Fastboot with a leaked engineering version.

Starting booted into the OS with a USB-C cable attached (File Transfer mode, USB Debugging on):

Settings - General - About Phone - Software Info

Verify that Software Version lists as US99610f

Copy the twrp-3.0.2-1-us996.img file into the folder containing the LG V20 Root Package

Open a command prompt window and change to the folder containing the LG V20 Root Package and run "Step1.bat"

It will push multiple files to the phone and apply some patches/exploits.

This proces will take 5 minutes and put you out at an "elsa:/ $" prompt

At this "elsa:/ $" prompt in your command prompt window type the following:

run-as con
chmod 0777 /storage/emulated/0/*

On the phone, launch Terminal Emulator and run the following:

id

Verify that the string which comes back contains the string "context-u:r:untrusted_app".

If not, run Step1.bat again, else continue forward

Enter the follosing command into Terminal Emulator (be very careful to type it properly):

applypatch /system/bin/atd /storage/emulated/0/dirtysanta

If that command came back with an error, close and re-open Terminal Emulator and try again

The command should begin to patch another file. This will take 5 minutes and will return you to the "elsa:/ $" prompt in Terminal Emulator when it has finished

Open another command prompt to the same folder and run "Step2.bat"

This step will download backup copies of the boot and aboot partitions from the phone then boot the phone into bootloader/fastboot mode.

You'll know it worked if the first line at the top of the phone screen appears in red

In the command prompt window, run Step3.bat

It will flash boot1.img and the TWRP Recovery image multiple times then restart the phone

The phone will hang, no matter how long it's left. Wait 5 minutes (at least until the logo re-loads once) then do the following:

Unplug the USB-C cable

Remove the battery from the phone to turn it off

Replace the battery

Boot into Fastboot mode and run the following commands in your command prompt:

fastboot flash boot bootbackup.img

Remove the USB-C cable and battery to turn off the phone. Then replace the battery and enter Recovery Mode

The phone will show a big red exclamation mark saying "Your device is corrupt". This is normal. It will go away after a few seconds then boot into recovery. This error screen is the result of the engineering "aboot" image that was flashed to give us an unlocked bootloader and will always happen on boot.

7 - Boot to old TWRP and install new TWRP

The old version of TWRP recovery will load. Don't ask me why we can't just go straight to new TWRP above, it didn't work well when I tried it.

If it asks for a password to decrypt data, click Cancel

Swipe to allow modifications

Install - Select Storage - MicroSD Card - OK

Install Image - Scroll down and tap the "twrp-3.5.1_9-0-us996.img"

Select the Recovery partition and swipe to confirm flash

Back to main menu

Reboot - Recovery

8 - Boot to new TWRP, install LineageOS, Google Apps, and flash modem partition image

The new version of TWRP will load:

Check the "Never show this screen during boot again" box

Swipe to allow modifications

Wipe - Format Data - type "yes" to continue

This is likely to fail the first time. Repeat it to properly format the data partition.

Go back to Main Menu - Wipe - Advanced Wipe - Select "Dalvik / ART Cache", "System", and "Cache"

Swipe to wipe

Back to main menu

Advanced - ADB Sideload

Plug in USB-C cable

Swipe to start sideload

In command prompt window on PC type the following:

adb sideload lineage-18.1-20210506-nightly-h910-signed.zip

When complete tap "back" and "ADB Sideload" and swipe again to apply another file:

adb sideload MindTheGapps-11.0.0-arm64-20210412_124247.zip

If you want to root the phone (completely optional, not necessary for this process), now is the time to do it. Tap "back" and "ADB Sideload" and swipe again to apply another file:

adb sideload Magisk-v23.zip

Go back to main menu - Install - Install Image - tap the h915freedommobilemodem.img file

Select the Modem partition and swipe to confirm flash

Remove USB-C cable

9. Reboot to LineageOS

Go back to main menu - Reboot - System - Swipe to reboot

References where I got the info to make this tutorial

Official Lineage 18.1 for LG V20 Release Thread

LineageOS Wiki for H910

DirtySanta Bootloader Unlock and Root Guide (Original)

H910 Rooting Thread (Cross-flash H915 then DirtySanta to US996)

H915 Root, TWRP using DirtySanta [WorkingSignals]

Noob Friendly Root TWRP using DirtySanta

General info about Modem Hardware, Firmware, Radio Interface Layer