A new method to unlock almost all g8 bootloaders maybe?

A new method to unlock almost all g8 bootloaders maybe? - LG G8 Guides, News, & Discussion

Hey guys,
Some guy posted a way to unlock any g8 bootloader via v50s engineering bootloader on sone chinese website. I dont know if im allowed to link it but its via qfil. I dont own a g8 right now but if anyone wants to try it i guess you could message me. Again this is via 9008 mode via qfil and flashing the abl partitions as well as the xbl partitions.

Awesomeslayerg said:
Hey guys,
Some guy posted a way to unlock any g8 bootloader via v50s engineering bootloader on sone chinese website. I dont know if im allowed to link it but its via qfil. I dont own a g8 right now but if anyone wants to try it i guess you could message me. Again this is via 9008 mode via qfil and flashing the abl partitions as well as the xbl partitions.
Click to expand...
Click to collapse
Can you post the link? I have done a lot of research on this and talked to the guy from China who sells all the hardware modded phones on taobao, and he and others have all confirmed that the bbs.gfan guides only work on this hw modded phones. I am fairly confident that the firehose used in this guide will be the xiamo 855 one which will not work on a normal g8

antintin said:
Can you post the link? I have done a lot of research on this and talked to the guy from China who sells all the hardware modded phones on taobao, and he and others have all confirmed that the bbs.gfan guides only work on this hw modded phones. I am fairly confident that the firehose used in this guide will be the xiamo 855 one which will not work on a normal g8
Click to expand...
Click to collapse
If youre willing to test and try it
https://bbs.lge.fun/thread-110.htm
That wouldnt make any sense. They all just want to make money thats what people will tell you thats itd impossible. Xsavi for the g7 also confirmed for the firehose for that g7 with that chipset would work.

Awesomeslayerg said:
If youre willing to test and try it
https://bbs.lge.fun/thread-110.htm
That wouldnt make any sense. They all just want to make money thats what people will tell you thats itd impossible. Xsavi for the g7 also confirmed for the firehose for that g7 with that chipset would work.
Click to expand...
Click to collapse
It does make a lot of sense... LG put soc protections while xiamo not as much, and the xiaomi firehose will work with a "stock" sdm 855 soc. The 845 firehose for the g7 has been leaked, so that works. I've personally made accounts and gotten the firehose from a number of posts and it's the xiaomi one

antintin said:
It does make a lot of sense... LG put soc protections while xiamo not as much, and the xiaomi firehose will work with a "stock" sdm 855 soc. The 845 firehose for the g7 has been leaked, so that works. I've personally made accounts and gotten the firehose from a number of posts and it's the xiaomi one
Click to expand...
Click to collapse
You could at least try putting it in qfil mode and try opening the partition mamager with it to check and maybe read the data from it.

antintin said:
It does make a lot of sense... LG put soc protections while xiamo not as much, and the xiaomi firehose will work with a "stock" sdm 855 soc. The 845 firehose for the g7 has been leaked, so that works. I've personally made accounts and gotten the firehose from a number of posts and it's the xiaomi one
Click to expand...
Click to collapse
Xiaomi has the same protection
The HW modded ones are just changed SoCs, switching from LG one to a Xiaomi one. Xiaomi releases their firehose for every phone they release.
Firehose/9008 mode are manufacturer dependant (could even me made model dependant). The code for the 9008 is in the SoC directly (not on some flash memory around...), and every manufacturer basically gets an encryption code for a certain SoC, and that one is used for the Sahara Procotol (9008 mode), and the corresponding firehose has the same code in it, so they can communicate.
Switch SoC with a different manufacturer -> Use their firehose.
Xiaomi ones are just easily available i guess in china (as they sit at the source), and freely available firehose -> even better.
Awesomeslayerg said:
If youre willing to test and try it
https://bbs.lge.fun/thread-110.htm
That wouldnt make any sense. They all just want to make money thats what people will tell you thats itd impossible. Xsavi for the g7 also confirmed for the firehose for that g7 with that chipset would work.
Click to expand...
Click to collapse
The "firehose for the g7" is a firehose for ALL LG (and only LG) SD845 devices, G7, V35 and V40. It wont work for a Oneplus, or a Xiaomi or so.
But yeah, they all want to make money, thats why firehoses usually arent freely available, otherwise they couldnt sell their services
There exists a firehose for LG SD855 devices... and a few people have it already, but why give it out for free, when you can make tons of money with it (especially when they very likely had to pay a ton of money to get it in the first place).

SGCMarkus said:
Xiaomi has the same protection
The HW modded ones are just changed SoCs, switching from LG one to a Xiaomi one. Xiaomi releases their firehose for every phone they release.
Firehose/9008 mode are manufacturer dependant (could even me made model dependant). The code for the 9008 is in the SoC directly (not on some flash memory around...), and every manufacturer basically gets an encryption code for a certain SoC, and that one is used for the Sahara Procotol (9008 mode), and the corresponding firehose has the same code in it, so they can communicate.
Switch SoC with a different manufacturer -> Use their firehose.
Xiaomi ones are just easily available i guess in china (as they sit at the source), and freely available firehose -> even better.
The "firehose for the g7" is a firehose for ALL LG (and only LG) SD845 devices, G7, V35 and V40. It wont work for a Oneplus, or a Xiaomi or so.
But yeah, they all want to make money, thats why firehoses usually arent freely available, otherwise they couldnt sell their services
There exists a firehose for LG SD855 devices... and a few people have it already, but why give it out for free, when you can make tons of money with it (especially when they very likely had to pay a ton of money to get it in the first place).
Click to expand...
Click to collapse
I googled aroumd for hw modded lg g8 and i couldnt find them. Im gonna buy a us model soon to try it out.

Awesomeslayerg said:
I googled aroumd for hw modded lg g8 and i couldnt find them. Im gonna buy a us model soon to try it out.
Click to expand...
Click to collapse
Yeah because they are only on taobao and Chinese sites. Also Google translate calls it "hard solution" instead of hardware modded btw. You can just look up LG g8 root taobao and you'll find them

Awesomeslayerg said:
I googled aroumd for hw modded lg g8 and i couldnt find them. Im gonna buy a us model soon to try it out.
Click to expand...
Click to collapse
Dude look... See the screenshot? That is the firehose link from that website and its this same link we've seen before, and it's THE XIAOMI FIREHOSE

I tried that firehose a few weeks ago with G8. Does not connect with qfil or octopus jtag.

zeek6228 said:
I tried that firehose a few weeks ago with G8. Does not connect with qfil or octopus jtag.
Click to expand...
Click to collapse
Were you the one who tried to cross flash with octoplus box? Has anything else happened with that

antintin said:
Were you the one who tried to cross flash with octoplus box? Has anything else happened with that
Click to expand...
Click to collapse
Yes I tried to crossflash G8 with octopus. It gives IMPL error. You still have download mode but no kdz for Sprint/AT&T. All of these can be sent back to LG for warranty, it is no big deal.

zeek6228 said:
Yes I tried to crossflash G8 with octopus. It gives IMPL error. You still have download mode but no kdz for Sprint/AT&T. All of these can be sent back to LG for warranty, it is no big deal.
Click to expand...
Click to collapse
Do you have any info about when the firehose will be added to octopus

@antintin
https://mega.nz/file/k4p0VSxQ#ejn3vqW12ivdLhLuT8DjfWRLE4KiUc6AAPc7_QlMFt0
Reuploaded SDM 855 firehose file from the LGE fun thread, managed to create a baidu account last night and get it downloaded.
edit:
Reuploaded the QPST file linked on the LGE.fun thread as well here:
https://mega.nz/file/Uw5SwChQ#g7jz3ma2vxVDZQ_UcFN59vycFvukpOfq_dCFUiGYVR4
ABL and XBL files as well: https://mega.nz/file/plYglChY#-DRLO0ZouCxtOP2ZanRrnE2R7pMjmANgYMheRk3BEHc
VOLTE files: https://mega.nz/file/BkxzELaD#kILReW8bPuYb17bSDn29TewQCa93YzNiQtK0au3S2Xg

jazir said:
@antintin
https://mega.nz/file/k4p0VSxQ#ejn3vqW12ivdLhLuT8DjfWRLE4KiUc6AAPc7_QlMFt0
Reuploaded SDM 855 firehose file from the LGE fun thread, managed to create a baidu account last night and get it downloaded.
edit:
Reuploaded the QPST file linked on the LGE.fun thread as well here:
https://mega.nz/file/Uw5SwChQ#g7jz3ma2vxVDZQ_UcFN59vycFvukpOfq_dCFUiGYVR4
ABL and XBL files as well: https://mega.nz/file/plYglChY#-DRLO0ZouCxtOP2ZanRrnE2R7pMjmANgYMheRk3BEHc
VOLTE files: https://mega.nz/file/BkxzELaD#kILReW8bPuYb17bSDn29TewQCa93YzNiQtK0au3S2Xg
Click to expand...
Click to collapse
We've had those files for a while they aren't really of use to us

For those not following the other threads, I'm cross posting , its not directly for bootloader unlocking but if the exploit is transferable, it's a promising first step.
If there was ever a time to stop OTA updating, now is it!
For those not already following, check out:
https://forum.xda-developers.com/v50-thinq/development/lg-v50-temp-root-exploit-via-cve-2020-t4098077
Basically they've figured out a way to get temp root on the Lg V50 which may lead to bootloader unlocking and permanent root.
One caveat, this exploit is likely patched in newer OTA updates of Android 10 (need March or older) and the exploit has to be changed for each firmware version. Not a big deal for those that have public KDZs but for Sprint devices hopefully the images are similar enough that the required addresses are the same across the variants. Here's hoping (I've got two Sprint devices).
Thanks to antintin as their rollback guide will become crucial for many:
https://forum.xda-developers.com/lg-g8/how-to/people-trying-beta-want-to-revert-t4011925

kevin_bouchard said:
For those not following the other threads, I'm cross posting , its not directly for bootloader unlocking but if the exploit is transferable, it's a promising first step.
If there was ever a time to stop OTA updating, now is it!
For those not already following, check out:
https://forum.xda-developers.com/v5...g-v50-temp-root-exploit-via-cve-2020-t4098077
Basically they've figured out a way to get temp root on the Lg V50 which may lead to bootloader unlocking and permanent root.
One caveat, this exploit is likely patched in newer OTA updates of Android 10 (need March or older) and the exploit has to be changed for each firmware version. Not a big deal for those that have public KDZs but for Sprint devices hopefully the images are similar enough that the required addresses are the same across the variants. Here's hoping (I've got two Sprint devices).
Thanks to antintin as their rollback guide will become crucial for many:
https://forum.xda-developers.com/lg-g8/how-to/people-trying-beta-want-to-revert-t4011925
Click to expand...
Click to collapse
We're not sure about bl unlock yet because one user with the Korean v50 tried to dd flash the abl, xbl, and xbl config, and the command went through successfully, but the files didn't stay after reboot. Maybe there's a way around this, but who knows.

antintin said:
We're not sure about bl unlock yet because one user with the Korean v50 tried to dd flash the abl, xbl, and xbl config, and the command went through successfully, but the files didn't stay after reboot. Maybe there's a way around this, but who knows.
Click to expand...
Click to collapse
I have some insight on the issue of the files not staying. It has to do with the partition size differences of the engineering abl bootloader and the phone's original bootloader. The original abl partition on the actual UFS chip is about 1-2 MB in size, when the engineering image is only about 300 KB. When writing the partition through dd or Octoplus Box, it is only written to the start of the partition. The issue is that it is not written properly and the system believes it is corrupt due to a size mismatch (the disk tells us the partition is 300 KB, while the GPT table tells us it's 2 MB). For instance, this is an issue also encountered when flashing a system image in TWRP (uses dd method) that is not exactly the size of the target partition (writing a 5 GB image to a 64 GB disk). The solution is to write the disk partitions from fastboot, since it automatically resizes the disk image to fit onto a larger disk partition. Unfortunately in this case, we do not have fastboot to do this. A workaround is to write the abl partition onto the laf partition (download mode), and then enter download mode which will enter into fastboot mode as normal. Another solution could be to resize the abl partition to fit before writing it, but I am unaware of how to do this. Also, using an alternative Linux utility instead of dd could solve this issue...

Related

Need AT&T full stock image to unbrick

Hi!
It was a bad idea to flash 356510B0982Axon M RU image (available on Russian zte website) to my ATT ZTE Z999.
Phone bricked and only visible by my PC as QUSB_BULK. Looks like there is a way to restore it, but i need full original working stock ATT image (any version). Does someone can share it?
Found at many places, but all of them wants money I would pay, if it will be 5 but not 25euro

I flashed mine using this[Leakite]ROM_AXON_M_VDF_SDCARD_SOFTWARE_PACKAGE_MR00a and it's not turning on anymore. We need help :crying:

Looks like we need 348010B3014Z999V1.0.0B30.zip
But i can't find it in free access, only payment sites like easy-firmware and grt-dongle

Any idea how we can flash a rom on edl mode?

No ideas for now. But friend of mine works in cellphone service center, he helped me many times to unbrick some devices. For now he is found firmware to restore Chinese axonM, can't find at&t

Ok, i got image... 10$ wasted It really looks like correct AT&T image, but QFIL, MiFlash, QPST, QComDownloadTool (ZTE util) can't flash it
https://drive.google.com/file/d/1n0qjH1vaTQVwckFPizSAMDHrBh6uA8b6/view?usp=sharing

BRuTe007 said:
Ok, i got image... 10$ wasted It really looks like correct AT&T image, but QFIL, MiFlash, QPST, QComDownloadTool (ZTE util) can't flash it
https://drive.google.com/file/d/1n0qjH1vaTQVwckFPizSAMDHrBh6uA8b6/view?usp=sharing
Click to expand...
Click to collapse
You need the firehose programmer and use parts of that firmware to flash with it

BRuTe007 said:
Ok, i got image... 10$ wasted It really looks like correct AT&T image, but QFIL, MiFlash, QPST, QComDownloadTool (ZTE util) can't flash it
https://drive.google.com/file/d/1n0qjH1vaTQVwckFPizSAMDHrBh6uA8b6/view?usp=sharing
Click to expand...
Click to collapse
... If you can get to edl mode, try those Axon 7 firehose programmers. Since they are the same platform. QFIL should flash this image zip with no problem.

Honami754 said:
... If you can get to edl mode, try those Axon 7 firehose programmers. Since they are the same platform. QFIL should flash this image zip with no problem.
Click to expand...
Click to collapse
Are you sure because im under the impression you can only use the exact specific firehose even if its the same chip i think its hard encoded into the shara protocol it will only except the same firehose but mabye im wrong thats just what ive known

Tried Axon 7 EDL Tool and it's won't work
stopped futher research and replaced MB from broken one that bought on ebay

Anyone attempted to flash this? I just got a new one and I'm scared flashing again. I'm thinking of just buying an At&t prepaid sim just to get the latest update.

tidus1ph said:
Anyone attempted to flash this? I just got a new one and I'm scared flashing again. I'm thinking of just buying an At&t prepaid sim just to get the latest update.
Click to expand...
Click to collapse
No reason to flash it if your axon not bricked. I's a stok ATT version.

BRuTe007 said:
No reason to flash it if your axon not bricked. I's a stok ATT version.
Click to expand...
Click to collapse
The one my phone got is the october 1, 2017 patch with build number Z999V1.0.0B21. So the download file is the newer-ish right? Because on the website the latest is sept 18, 2018 patch with build number Z999V1.0.0B35.

tidus1ph said:
The one my phone got is the october 1, 2017 patch with build number Z999V1.0.0B21. So the download file is the newer-ish right? Because on the website the latest is sept 18, 2018 patch with build number Z999V1.0.0B35.
Click to expand...
Click to collapse
This one was named 348010B3014Z999V1.0.0B30.zip and i think B35 newer then this one.

Here are the Z999 and Z-01K firehose files, extracted from an Internal ZTE tool I have. Hope it helps people out
Z-01K (Japanese Axon M)
https://www.androidfilehost.com/?fid=1395089523397896977
Z999
https://www.androidfilehost.com/?fid=1395089523397896976
All I ask is if you use these files in a guide or anything that you credit me for providing them because i needed to pay to grab these.

deadman96385 said:
Here are the Z999 and Z-01K firehose files, extracted from an Internal ZTE tool I have. Hope it helps people out
Z-01K (Japanese Axon M)
https://www.androidfilehost.com/?fid=1395089523397896977
Z999
https://www.androidfilehost.com/?fid=1395089523397896976
All I ask is if you use these files in a guide or anything that you credit me for providing them because i needed to pay to grab these.
Click to expand...
Click to collapse
Forgive my ignorance. But what does these files do? z999 is the at&t's version right?

tidus1ph said:
Forgive my ignorance. But what does these files do? z999 is the at&t's version right?
Click to expand...
Click to collapse
The firehose is needed to flash the device with QFIL, miflash, etc so a device can be unbricked.

deadman96385 said:
The firehose is needed to flash the device with QFIL, miflash, etc so a device can be unbricked.
Click to expand...
Click to collapse
Tried to flash with Miflash but that failed starts flashing but then says : Cannot Read Port and stops flashing.
Also tried QFIL But also fails with this message : Download Fail:Sahara Fail:QSaharaServer Failrocess fail
hope somone can clarify if its even possible to recover.
this brick happend after update.

Reverender said:
Tried to flash with Miflash but that failed starts flashing but then says : Cannot Read Port and stops flashing.
Also tried QFIL But also fails with this message : Download Fail:Sahara Fail:QSaharaServer Failrocess fail
hope somone can clarify if its even possible to recover.
this brick happend after update.
Click to expand...
Click to collapse
Sounds like you have a driver issue make sure you install the Qualcomm drivers

deadman96385 said:
Sounds like you have a driver issue make sure you install the Qualcomm drivers
Click to expand...
Click to collapse
UPDATE:
figured out what is wrong with QFIL
the Firehose File you send reads only 0 bytes this is why qfil stoped working. might also be the problem with the rest of the flashers i tried.
anycase the elf file in the zip is broken ?
any case you have a .MBN version instat of a .ELF maybe that works ?
Seems im making progress.
im using ToolStudio right now.
the only thing i guess is holding me back is im missing 2 files: RAM and Boot image.
these are not present in the firmware file.
is there anyway i could get them ?

Help! I tried to cross flash my T-Mobile V40 and ended up bricking it.

I ignored the warnings... I know, idiot.
But I went ahead and it completed.
But now the phone has a black screen and nothing else.
When plugged in, my computer recognises it as Qualcomm 9800 port 30.
Still nothing on screen though.
Anyway to get it back? Or get it to stock rom? Really don't want tmobile bloat all over it if possible.

Your only hope would be to get someone who has a T-Mobile v40 to dump all partitions from their phone, and make those partitions available to you.
You would then use 9008 mode to upload partition after partition to your phone. And I'm not even sure that would work.
Enjoy your paperweight / doorstop / skipping stone / table leveler / shim.
[NG]Owner

Double post.

What is it about the T-Mobile version that makes it so different to the others.

NGOwner said:
Your only hope would be to get someone who has a T-Mobile v40 to dump all partitions from their phone, and make those partitions available to you.
You would then use 9008 mode to upload partition after partition to your phone. And I'm not even sure that would work.
Enjoy your paperweight / doorstop / skipping stone / table leveler / shim.
[NG]Owner
Click to expand...
Click to collapse
From what I have seen on some other posts is that can cause the IMEI to return as 0. It may only be if you overwrite the modem partition though, so don't do that. You may only need the T-Mobile bootloader.

shawnmos said:
From what I have seen on some other posts is that can cause the IMEI to return as 0. It may only be if you overwrite the modem partition though, so don't do that. You may only need the T-Mobile bootloader.
Click to expand...
Click to collapse
It's not the modem partition, it's the ftm (and maybe some others too)

I was in a similar situation two days ago; I tried crossflashing my V405UA to T-Mobile and got stuck with no signs of life other than 9008 mode. After a few hours of panicking I was able to figure out how to use QFIL and got things back up and running. I did accidentally wipe my serial number and MAC address in the process from the looks of it, but my IMEI is still intact.
So, I know the V405TA is different from the V405UA and other variants, but I think you can probably get it back through 9008 mode. Feel free to send a PM if you'd like to talk more about it, just keep in mind that I'm far from an expert on any of this. The steps I took were basically:
- Get QFIL and the programmer from here: https://forum.xda-developers.com/lg-v40/how-to/unlock-lg-v40-via-9008-root-t-mobile-t4042207
- Backup the necessary partitions (I didn't do this and now I don't have a S/N or MAC address although my IMEI is fine; I'm not sure which partitions you need to save but definitely look into that).
- Grab a copy of https://github.com/ANEP-ET/kdztools, it's a fork of kdztools that can generate rawprogram*.xml files.
- Get a KDZ from somewhere and use the tools to extract it and generate rawprogram*.xml files.
- You might need to edit rawprogram1.xml through rawprogram6.xml; IIRC I had to add "B." to the start of all of the filenames in rawprogram1.xml, "C." to the start of all of the files in rawprogram2.xml, and so on. I didn't have to change rawprogram0.xml.
- Add all of the rawprogram*.xml files in QFIL, I don't think you need a patch.xml (I clicked "Cancel" when asked for a patch file and everything still worked).
- Flash and you should hopefully be good to go.
Keep in mind that I don't really know what I'm doing so be careful and use common sense, this is just what worked for me. Feel free to PM if you want to discuss or have questions and good luck!

aw2a said:
I was in a similar situation two days ago; I tried crossflashing my V405UA to T-Mobile and got stuck with no signs of life other than 9008 mode. After a few hours of panicking I was able to figure out how to use QFIL and got things back up and running. I did accidentally wipe my serial number and MAC address in the process from the looks of it, but my IMEI is still intact.
So, I know the V405TA is different from the V405UA and other variants, but I think you can probably get it back through 9008 mode. Feel free to send a PM if you'd like to talk more about it, just keep in mind that I'm far from an expert on any of this. The steps I took were basically:
- Get QFIL and the programmer from here: https://forum.xda-developers.com/lg-v40/how-to/unlock-lg-v40-via-9008-root-t-mobile-t4042207
- Backup the necessary partitions (I didn't do this and now I don't have a S/N or MAC address although my IMEI is fine; I'm not sure which partitions you need to save but definitely look into that).
- Grab a copy of https://github.com/ANEP-ET/kdztools, it's a fork of kdztools that can generate rawprogram*.xml files.
- Get a KDZ from somewhere and use the tools to extract it and generate rawprogram*.xml files.
- You might need to edit rawprogram1.xml through rawprogram6.xml; IIRC I had to add "B." to the start of all of the filenames in rawprogram1.xml, "C." to the start of all of the files in rawprogram2.xml, and so on. I didn't have to change rawprogram0.xml.
- Add all of the rawprogram*.xml files in QFIL, I don't think you need a patch.xml (I clicked "Cancel" when asked for a patch file and everything still worked).
- Flash and you should hopefully be good to go.
Keep in mind that I don't really know what I'm doing so be careful and use common sense, this is just what worked for me. Feel free to PM if you want to discuss or have questions and good luck!
Click to expand...
Click to collapse
Why would you want to flash a T-Mobile stock ROM?

Ainz_Ooal_Gown said:
Why would you want to flash a T-Mobile stock ROM?
Click to expand...
Click to collapse
I'd really like to get Android 10 on my V40, but I don't seem to get OTA updates since AFAICT I have an ATT variant that has been crossflashed to US Cellular (I got it on eBay). Unfortunately the only (stock) Android 10 ROM I can find is for the T-Mobile variant, so I figure I'd give it a go; I know that the T-Mobile variant is a bit different from the others but I thought I'd try anyway since I was curious. In the end, aside from some panic (and a missing S/N and MAC address) no harm was done and I learned a lot, so that's nice. And, hopefully, I can use what I learned to help other people in a similar situation now (even though I'm far from an expert).

aw2a said:
I'd really like to get Android 10 on my V40, but I don't seem to get OTA updates since AFAICT I have an ATT variant that has been crossflashed to US Cellular (I got it on eBay). Unfortunately the only (stock) Android 10 ROM I can find is for the T-Mobile variant, so I figure I'd give it a go; I know that the T-Mobile variant is a bit different from the others but I thought I'd try anyway since I was curious. In the end, aside from some panic (and a missing S/N and MAC address) no harm was done and I learned a lot, so that's nice. And, hopefully, I can use what I learned to help other people in a similar situation now (even though I'm far from an expert).
Click to expand...
Click to collapse
Ahh I see well we do have Android 10 in the flavors of LOS 17.1 and Havoc OS 3.5..

No firehose loader for the T-Mobile one so you can't fix in 9008 mode. It is a paperweight. You need to replace the motherboard.

Bump? Any way to revive it?

slebeau1988 said:
Bump? Any way to revive it?
Click to expand...
Click to collapse
You could try asking tmobile for help and see how much they'll charge you. You may get lucky if the phone is still in warranty

About H870 Unsupported market unlock

Hi everyone. i need some help to unlock bootloader for my LG g6 (h870 TR). i found some unlock method for unsupported device with QFil (
) . So, Any idea ?

I didn't watch the full video. But I did scroll through most of it.
A quick TL;DW (too long, didn't watch) that might contain some gaps, so beware:
Basically he flashes the V35's engineering aboot (ABL) to his G7 using QFIL (which, anyone correct me if I'm wrong, it's a little bit too far for the average user, but hey, let's move along). Then, he flashes another thing to recover fastboot access (still using QFIL), and then he flashes something to the FRP partition (whatever that was) from the "UnlockG7" thing using fastboot. And then he proceeds to unlock the phone.
Or... just follow this thread and read it: https://forum.xda-developers.com/t/...cept-t-mo-via-edl-mode-easier-method.4077105/
Waiting for other people to comment.

Mr.Indigo said:
I didn't watch the full video. But I did scroll through most of it.
A quick TL;DW (too long, didn't watch) that might contain some gaps, so beware:
Basically he flashes the V35's engineering aboot (ABL) to his G7 using QFIL (which, anyone correct me if I'm wrong, it's a little bit too far for the average user, but hey, let's move along). Then, he flashes another thing to recover fastboot access (still using QFIL), and then he flashes something to the FRP partition (whatever that was) from the "UnlockG7" thing using fastboot. And then he proceeds to unlock the phone.
Or... just follow this thread and read it: https://forum.xda-developers.com/t/...cept-t-mo-via-edl-mode-easier-method.4077105/
Waiting for other people to comment.
Click to expand...
Click to collapse
Well, your guesses are correct. i want to using this method for my LG G6. But i need some files ( for example; abl file, firehose or 9008 recovery file for g6). Any Prof XDA members find this solution ?

TugrulTolu said:
Well, your guesses are correct. i want to using this method for my LG G6. But i need some files ( for example; abl file, firehose or 9008 recovery file for g6). Any Prof XDA members find this solution ?
Click to expand...
Click to collapse
I really don't remember of any engineering aboot for the G6. I do know we have the firehose laying around the web, but not the engineering ABL.
AFAIK there's one for the V20, but I really don't remember about having one for the G6.
And, if I'm not getting crazy or lazy, maybe runningak3d tried this on his AS993 thread. or the "root for every model" thread. I really don't remember.
TBH, I think this should be done in a donor phone first. Mainly because it's too risky. We're talking about a lotta work and unknown puzzle pieces (such as the aboot).
Also, I've pointed out above regarding the V20's engineering aboot. While the V20 uses the 820, while the G6 uses the 821. That shouldn't be an issue (as pointed out by runningak3d on his threads, because both of them are MSM8996 CPUs), but I'd still try this in a donor phone first, as they've tested this before and the result was pretty much catastrophic (phone bricked).

Mr.Indigo said:
I really don't remember of any engineering aboot for the G6. I do know we have the firehose laying around the web, but not the engineering ABL.
AFAIK there's one for the V20, but I really don't remember about having one for the G6.
And, if I'm not getting crazy or lazy, maybe runningak3d tried this on his AS993 thread. or the "root for every model" thread. I really don't remember.
TBH, I think this should be done in a donor phone first. Mainly because it's too risky. We're talking about a lotta work and unknown puzzle pieces (such as the aboot).
Also, I've pointed out above regarding the V20's engineering aboot. While the V20 uses the 820, while the G6 uses the 821. That shouldn't be an issue (as pointed out by runningak3d on his threads, because both of them are MSM8996 CPUs), but I'd still try this in a donor phone first, as they've tested this before and the result was pretty much catastrophic (phone bricked).
Click to expand...
Click to collapse
thanks for enlightening

TugrulTolu said:
Well, your guesses are correct. i want to using this method for my LG G6. But i need some files ( for example; abl file, firehose or 9008 recovery file for g6). Any Prof XDA members find this solution ?
Click to expand...
Click to collapse

Unlock ANY Pixel from Carrier

____________________________________________________
UPDATE AS OF 16 OF MAY 2023:
The security patch of December of 2022 fixed the patch, so it doesn't work on this version and newer ones.
The project is still alive and I am working to get the exploit to work on newer version, but for now haven't found any.
However due to the complex nature of the project and that I have little free time, expect this to take sometime until a new exploit is available.
If anyone has any ideas or suggestions please let me know! Any help is welcome
____________________________________________________
Hey everybody!
So recently I bought a Google Pixel 4 XL. The thing is that in Europe they are too expensive compared to the US, so I bought one that was from AT&T(used of course). However is that I need to use my SIM on the phone, but of course, the phone refused to allow me to use my SIM from Spain. ⛔️
So after hours of research, I found a way to unlock it. Here are the steps:
1. Remove your SIM card if it is on the phone
2. Do a factory reset
3. Do OFFLINE SETUP. Also, DON'T PUT ANY PASSWORD OR ANY TYPE OF SCREEN LOCK
4. Once you are on the main screen, enable USB Debugging.
5. Connect the phone to the computer (I assume you already have the USB drivers, platform-tools downloaded and knowledge on how to use ADB commands. If you don't have the SDK downloaded, head to this link and follow the instructions)
6. Inside the platform-tools folder, open a terminal window and run "adb shell"(on mac, once you are on the directory you have to run "./adb shell") and then "pm uninstall -k --user 0 com.google.android.apps.work.oobconfig" (run them without quotes)
After this, you can already connect the phone to the internet and put your SIM in.
This didn't unlock the phone though . What we have just done is this:
When we connect the phone to the internet, it verifies if it should lock the SIM or not. So we did a setup without internet, so the phone can't do that. After that, we uninstall the package responsible for doing this.
So when we connect it to the internet, it won't check the SIM lock
However, the bootloader is still locked and grey out. This is because this app is responsible to grey or not the bootloader switch. If it is from a carrier, the package will disable the switch, and if not you will have the ability to unlock it. As we kill the app before it could do its job, the bootloader will be waiting until the package gives its answer.
Special thanks to this Jorge Cortés to make this post possible.
If you find the post useful, consider buying me a cup of coffee please with Revolut.

If anyone has problems/doubts please let me know!

Esim is unlocked as well?

Didn't try but should work, as the phone never check if it is from a carrier or not.

#mcl said:
Didn't try but should work, as the phone never check if it is from a carrier or not.
Click to expand...
Click to collapse
On another post someaone said esim is working on pixel 4 verizon unlocked trought this steps. So as you say, it works.
Thanks

Danny17va said:
On another post someaone said esim is working on pixel 4 verizon unlocked trought this steps. So as you say, it works.
Thanks
Click to expand...
Click to collapse
No problem. Just for curiosity, who did the test on unlocked Verizon Pixel?

Is there any work around to unlock to bootloader too??

Daniyal48 said:
Is there any work around to unlock to bootloader too??
Click to expand...
Click to collapse
Hey,
I am working on that. As it turns out there is a way to flash firmware to any device with a Qualcomm chip, even if the bootloader os locked. It's called EDL mode. This mode was designed to force flash firmware in bricked devices that can't use fastboot or adb.
I already find the app I need to flash, actually there a a lot of different ones( I chose QPST) but it needs some strange files that I didn't find yet, and it won't allow em to use the google firmware neither .
So when I find those files I will write a detailed guide on how to unlock the bootloader , but for now I only know how to use any SIM on a locked Pixel device.

#mcl said:
Hey,
I am working on that. As it turns out there is a way to flash firmware to any device with a Qualcomm chip, even if the bootloader os locked. It's called EDL mode. This mode was designed to force flash firmware in bricked devices that can't use fastboot or adb.
I already find the app I need to flash, actually there a a lot of different ones( I chose QPST) but it needs some strange files that I didn't find yet, and it won't allow em to use the google firmware neither .
So when I find those files I will write a detailed guide on how to unlock the bootloader , but for now I only know how to use any SIM on a locked Pixel device.
Click to expand...
Click to collapse
I have tried the same on a OnePlus device but they have MSM Tool to thet let you work in edl mode but I haven't found any tool for Pixel devices yet

Daniyal48 said:
I have tried the same on a OnePlus device but they have MSM Tool to thet let you work in edl mode but I haven't found any tool for Pixel devices yet
Click to expand...
Click to collapse
yeah unlike Oneplus Google didn't release any software designed specifically to the Pixel lineup, so you have to use the generic Qualcomm tools.

#mcl said:
yeah unlike Oneplus Google didn't release any software designed specifically to the Pixel lineup, so you have to use the generic Qualcomm tools.
Click to expand...
Click to collapse
Can you name other generic Qualcomm tools so I can experiment with them??

Yeah of course, there is QFIL also and some others that aren't official. I downloaded them from Androidmtk website.
With this link you go to the qpst download and use instructions section of their webpage. At the bottom you will find similar programs, but I didn't get to try them. You can try them, but make sure they are for Qualcomm Chipset, because some of them are for mediatek phones.

#mcl said:
Yeah of course, there is QFIL also and some others that aren't official. I downloaded them from Androidmtk website.
With this link you go to the qpst download and use instructions section of their webpage. At the bottom you will find similar programs, but I didn't get to try them. You can try them, but make sure they are for Qualcomm Chipset, because some of them are for mediatek phones.
Click to expand...
Click to collapse
Okay thank you I hope i find a solution with this

Daniyal48 said:
Okay thank you I hope i find a solution with this
Click to expand...
Click to collapse
No problem, good luck researching .
I will keep searching as well to see if I can find those files

#mcl said:
No problem, good luck researching .
I will keep searching as well to see if I can find those files
Click to expand...
Click to collapse
If you find any files please also send them to me. Can we use a working Device to get these files from. Like we extract these files for a normal pixel 4 xl and then flash it to ours?

Daniyal48 said:
If you find any files please also send them to me. Can we use a working Device to get these files from. Like we extract these files for a normal pixel 4 xl and then flash it to ours?
Click to expand...
Click to collapse
Of course, if I find them I will make them available for anyone .
Yes in theory you can extract this files from your phon, however as mine is locked I need them from an unlocked pixel I suppose, but I didn't try to extract the files from my home and the flash them again, it could work. In the QPST you even have a section to that, it's a backup I Believe but not sure about the name.
If you try and it works let me know!

#mcl said:
Of course, if I find them I will make them available for anyone .
Yes in theory you can extract this files from your phon, however as mine is locked I need them from an unlocked pixel I suppose, but I didn't try to extract the files from my home and the flash them again, it could work. In the QPST you even have a section to that, it's a backup I Believe but not sure about the name.
If you try and it works let me know!
Click to expand...
Click to collapse
Yes I am also looking for an unlock Pixel 4 XL if I find one I will try extracting these files and post it somewhere on the internet so anyone can access it

Yeah that is a way, but I was thinking that maybe these files are inside of the IMG files of the firmware from Google, and that firmware isn't lock , so if anyone manage to find those files there you wouldn't need to buy another pixel to extract the firmware.
I also think that in reality you don't need the firmware but rather some files for your Qualcomm Chipset to get the Sahara protocol working and I believe later on you flash the firmware, however I am not sure about that as I didn't try it.
I think this because you can find some Qualcomm snapdragon 855 programmer files (which had the extension we need), so they may be basic files that activates the Sahara protocol (which is the one used when the phone is in this mode) and only after I believe you can flash the firmware using some commands.
I would like to try out this but I can't as it could brick my phone and I don't have other to use, and I don't have any other pixel, this is my first and only Pixel ever.
So if you have an older pixel and you want you could try this theory...

#mcl said:
Yeah that is a way, but I was thinking that maybe these files are inside of the IMG files of the firmware from Google, and that firmware isn't lock , so if anyone manage to find those files there you wouldn't need to buy another pixel to extract the firmware.
I also think that in reality you don't need the firmware but rather some files for your Qualcomm Chipset to get the Sahara protocol working and I believe later on you flash the firmware, however I am not sure about that as I didn't try it.
I think this because you can find some Qualcomm snapdragon 855 programmer files (which had the extension we need), so they may be basic files that activates the Sahara protocol (which is the one used when the phone is in this mode) and only after I believe you can flash the firmware using some commands.
I would like to try out this but I can't as it could brick my phone and I don't have other to use, and I don't have any other pixel, this is my first and only Pixel ever.
So if you have an older pixel and you want you could try this theory...
Click to expand...
Click to collapse
I have Pixel 2 XL but it doesn't boot into EDL i tried fastboot commands and also abd commands but it doesn't even go there...I have Pixel 3 XL on the way I will try on that but that is already unlocked

#mcl said:
Yeah that is a way, but I was thinking that maybe these files are inside of the IMG files of the firmware from Google, and that firmware isn't lock , so if anyone manage to find those files there you wouldn't need to buy another pixel to extract the firmware.
I also think that in reality you don't need the firmware but rather some files for your Qualcomm Chipset to get the Sahara protocol working and I believe later on you flash the firmware, however I am not sure about that as I didn't try it.
I think this because you can find some Qualcomm snapdragon 855 programmer files (which had the extension we need), so they may be basic files that activates the Sahara protocol (which is the one used when the phone is in this mode) and only after I believe you can flash the firmware using some commands.
I would like to try out this but I can't as it could brick my phone and I don't have other to use, and I don't have any other pixel, this is my first and only Pixel ever.
So if you have an older pixel and you want you could try this theory...
Click to expand...
Click to collapse
Mbn Files from Pixel 4 Request
As title states, I am looking for the mbn files from the pixel 4. I downloaded the modem partition and could not seem to extract it and thought someone that owns a pixel 4 might have better luck than me. Thanks! The directory might be...
forum.xda-developers.com
Are these files related to our issue

Development Prototype ABL Binary from Nokia XR20 for Bootloader Unlock.

Few months ago a customer asked me to flash couples of Nokia XR20 prototype unit for him, so I managed to get prototype ABL dump of this phone.
WARNING: This is not a guide! DO NOT TRY IT ON OTHER SNAPDRAGON 480 BASED NOKIA PHONES INCLUDING G50, X10, X20, X100, G300 - UNLESS YOU KNOW WHAT YOU'RE DOING!
To use it:
1. Enable flashing permission with HDK (an internal flash tool used by triple-color company, sorry can't disclose more details about that). Please search for related service online, we don't provide or promote such service.
2. Download Prototype ABL from following URL:
Click here
3. Flash prototype ABL and OEM unlock enabled frp partition manually, then you can confirm bootloader unlock:
Code:
fastboot flash abl TTG-abl.elf
fastboot reboot-bootloader
fastboot flashing unlock
fastboot flashing unlock_critical
4. Once bootloader unlock completed, please reinstall stock OS to restore ABL back to normal.
SHA256 checksum of ABL image: ac8143f6e0b449c39127aedd6463e2b9242cf37ce90a86c2988b885e34b0587f
Root Key Hash of ABL image: 622D3D5FE38C4198DDFABB264034EFDE58B986B510393A0CF163E803A3FD985E
Proof of concept is attached below, thanks to @singhnsk for testing.

Bro, Nokia x10 please?

HDK.
Where can I get?
Full name please of this app.

mishak750 said:
HDK.
Where can I get?
Full name please of this app.
Click to expand...
Click to collapse
nope, you can't use it, even if you get the full name

hikari_calyx said:
Few months ago a customer asked me to flash couples of Nokia XR20 prototype unit for him, so I managed to get prototype ABL dump of this phone.
WARNING: This is not a guide! DO NOT TRY IT ON OTHER SNAPDRAGON 480 BASED NOKIA PHONES INCLUDING G50, X10, X20, X100, G300 - UNLESS YOU KNOW WHAT YOU'RE DOING!
To use it:
1. Enable flashing permission with HDK (an internal flash tool used by triple-color company, sorry can't disclose more details about that). Please search for related service online, we don't provide or promote such service.
2. Download Prototype ABL from following URL:
Click here
3. Flash prototype ABL and OEM unlock enabled frp partition manually, then you can confirm bootloader unlock:
Code:
fastboot flash abl TTG-abl.elf
fastboot flash frp frp_oemunlock.img
fastboot reboot-bootloader
fastboot oem unlock-go
4. Once bootloader unlock completed, please reinstall stock OS to restore ABL back to normal.
SHA256 checksum of ABL image: ac8143f6e0b449c39127aedd6463e2b9242cf37ce90a86c2988b885e34b0587f
Proof of concept is attached below, thanks to @singhnsk for testing.
Click to expand...
Click to collapse
man, I'm jealous of XR20 users!
here's hoping that someone will find a X10 prototype soon!

AltFantasy said:
man, I'm jealous of XR20 users!
here's hoping that someone will find a X10 prototype soon!
Click to expand...
Click to collapse
THAT CAME TRUE, **** YEAH!!!

Posted new topic in X10/ X20 phone section, before reading everything up here...
Seems "up the sh*t creek without a paddle" situation.
Damn Nokia, but if anyone would get it working- I'll subscribe to this topic too.
Cheers!

Visionu said:
Bro, Nokia x10 please?
Click to expand...
Click to collapse
Prototype ABL binaries from Nokia X10 and X100, for bootloader unlock purpose.
If you've followed my prototype ABL image release topics so far, then you should know where it comes from. This topic will be edited later if X20 one is available. WARNING: This is not a guide! Prototype ABL binaries are provided as-is...
forum.xda-developers.com
Here you go

Trying not to be offtopic, why a decent phone, from a well known brand like Nokia, that often offered android one devices has now low to zero interest from developers? It's not polemic, I am just curious

phaleg said:
Trying not to be offtopic, why a decent phone, from a well known brand like Nokia, that often offered android one devices has now low to zero interest from developers? It's not polemic, I am just curious
Click to expand...
Click to collapse
Politics+proffits= end user loss
as it comes to coders, it's only so far we get allowed to delve in to, there was time, when I have physically remodded ZTE phone, from non funcioning device in to best phone at the time ALL- during one day on PC using no more that 3 tools and 2 ROM's... now you are constrained to even to get an access to bootloader or the way to extract it without phone started. Silly win for the google (nokia) developers in constraining modifications, with time, (loss of sales) that might change, hence "politics"

Anyone managed to enable boot loader access? Mine had already A13 (funk it) with oem function access disable (grey) in developer mode

phaleg said:
Trying not to be offtopic, why a decent phone, from a well known brand like Nokia, that often offered android one devices has now low to zero interest from developers? It's not polemic, I am just curious
Click to expand...
Click to collapse
because HMD just keeps on locking down everything, and tries to stop people from even unlocking the bootloaders by using broken bootloaders for retail units.
Hikari_Calyx once wrote a whole article on Medium on why it's stupidly hard to unlock the retail units (that are made by HMD), but TL;DR: HMD locks the bootloaders even further every time a new security/feature update is released to its phones by itself, and it even janks the code that makes up the phones' bootloaders, forcing people to use prototype ABL images to unlock the phones.
The fact that you even need prototype/unreleased models of the damn retail units to unlock those units themselves is stupid enough...
As for the older models (e.g: 8 PureView, or 6.1, or whatever before 2021-or-so, I suppose? because there are exceptions, like the G10/G20) though, they're fine. All you need is an unlock key (though, unfortunately, you have to buy the key...), and adb, then use the unlock key, and you're done! Nokia even provided a bootloader unlocking service before (although, they only offered it for a limited time, and it doesn't even work across all of their phones! - they only supported the Nokia 8, and the phone had to run on Android 8 with an old security patch, or else they wouldn't allow the unlocking!)

alegatorul said:
Anyone managed to enable boot loader access? Mine had already A13 (funk it) with oem function access disable (grey) in developer mode
Click to expand...
Click to collapse
that option is useless. Ignore that.

AltFantasy said:
because HMD just keeps on locking down everything, and tries to stop people from even unlocking the bootloaders by using broken bootloaders for retail units.
Hikari_Calyx once wrote a whole article on Medium on why it's stupidly hard to unlock the retail units (that are made by HMD), but TL;DR: HMD locks the bootloaders even further every time a new security/feature update is released to its phones by itself, and it even janks the code that makes up the phones' bootloaders, forcing people to use prototype ABL images to unlock the phones.
The fact that you even need prototype/unreleased models of the damn retail units to unlock those units themselves is stupid enough...
As for the older models (e.g: 8 PureView, or 6.1, or whatever before 2021-or-so, I suppose? because there are exceptions, like the G10/G20) though, they're fine. All you need is an unlock key (though, unfortunately, you have to buy the key...), and adb, then use the unlock key, and you're done! Nokia even provided a bootloader unlocking service before (although, they only offered it for a limited time, and it doesn't even work across all of their phones! - they only supported the Nokia 8, and the phone had to run on Android 8 with an old security patch, or else they wouldn't allow the unlocking!)
Click to expand...
Click to collapse
It's sad that Nokia so fiercely fights people that would like to use android "open" as it should be :/

phaleg said:
It's sad that Nokia so fiercely fights people that would like to use android "open" as it should be :/
Click to expand...
Click to collapse
nah, blame HMD for that.
Nokia is trying to distance itself from its past with their legendary phones (like the N95, E95, N97, 3310, and soooo much more!) now, starting from when they redesigned their logo to a more.... minimalistic look, I guess? and their booths in tech events (e.g: CES) now market their IoT tech, routers, and whatnot...
As for HMD, though, they'll keep on using the old logo, because muh homage to le legendary phones and all that, blah blah. (even though their "new" N95 prototype (you can view it in MrMobile's video about the old Nokia N95) is just essentially very uniform (with just a kickstand built into the camera unit, and speakers that slide out from the left side of the phone....))

HDM or Nokia, logic is the same, it is strange to be so stricth about modding android from a company that used to produce devices with Android one (if I am not mistaken, was the type of android very stock without producers modifications in the SW)

Right, now back as we should on topic..
How did you manage to unlock the bootloader & install twrp or similar app?

alegatorul said:
Right, now back as we should on topic..
How did you manage to unlock the bootloader & install twrp or similar app?
Click to expand...
Click to collapse
I don't know if my guide will also work for your device (though, I suspect it'll still work with the XR20, since all you have to do is flashing the ABL, then do the unlocking commands and all), but here's my guide on how to unlock the bootloader.
Do note, however, that my guide is for a different device (the X10), so it has a few differences here and there, from the XR20 (the unlock commands, and the ABL files). Hikari_Calyx has already given you the commands and files in his post, so just grab that from there.
As for TWRP, you'll have to port the recovery to your phone, which means learning programming and dealing with image layouts and whatnot...

phaleg said:
HDM or Nokia, logic is the same, it is strange to be so stricth about modding android from a company that used to produce devices with Android one (if I am not mistaken, was the type of android very stock without producers modifications in the SW)
Click to expand...
Click to collapse
hahaha, nah, just because a phone runs Android One, doesn't mean its manufacturer will do such a thing. Android One is just the software/operating system part of the phones, and as for the bootloader (which is in the firmware part of the phone), they can just modify it however they want, for the sake of "security" and "stability" and blah blah blah.
It's just like if PC motherboard manufacturers like MSI and ASUS lock people to just using Windows, without any capabilities to use other OSes (e.g: Linux), then claim that they haven't done any modifications to the OS.

AltFantasy said:
hahaha, nah, just because a phone runs Android One, doesn't mean its manufacturer will do such a thing. Android One is just the software/operating system part of the phones, and as for the bootloader (which is in the firmware part of the phone), they can just modify it however they want, for the sake of "security" and "stability" and blah blah blah.
It's just like if PC motherboard manufacturers like MSI and ASUS lock people to just using Windows, without any capabilities to use other OSes (e.g: Linux)
Click to expand...
Click to collapse
Cheers mate.
I'll try with unblocking...
Anyway, the phone is 1 month old under warranty still

Database Develop

welcome