Guide LG G8/G8x/v50 Bootloader Unlock and Magisk Root using Firehose - LG G8 Guides, News, & Discussion

Disclaimer: I am not responsible for any problems from using this guide.​Works for G8, G8s, G8x, and v50
Confirmed working on G8 and v50
Requirements: Android 10
QFIL: https://drive.google.com/file/d/1P7uGjIirqGRdkwlxgKf_idepDlv6_u-q/view?usp=sharing
QFIL Driver: https://drive.google.com/file/d/1sPJm1RuSoVX9JMEs-Gx8xNuEDadO6rpj/view?usp=sharing
LG Mobile Driver:
LG Mobile Phone - Drivers and Software Downloads | LG USA Support
LG Mobile Phone - Drivers and Software Downloads. Learn how to use, update, maintain and troubleshoot your LG devices and appliances.
www.lg.com
ADB: https://drive.google.com/file/d/1nvlwaicFpDN_4DGR0BZRWUDgwQwYzOhS/view?usp=sharing
Firehose: https://drive.google.com/file/d/1ekI_d2-P9GdoakkSgk2hK1WHbQLIPlTQ/view?usp=sharing
abl: https://drive.google.com/file/d/1sye4gXsDfD8JVF5qfAMG_GDxSLKY6J6Q/view?usp=sharing
Verizon LG G8 only frp: https://drive.google.com/file/d/1294cXerj2_EkeGw1p38CcVPuyRfdS9N5/view?usp=sharing
This Verizon FRP img was only tested on LG G8 Verizon and is not recommended to be used on other Verizon Variants as it will prevent the phone from booting.
Bootloader Unlock
Unlocking your bootloader will erase all data on your phone
First Install LG Mobile Driver, QFIL driver, and QFIL (Select first option, WWAN)
All Variants other than Verizon: Go to Settings, > System > About Phone > Software Info > Tap Build Number 7 Times.
Go back to Settings > System > Developer Options. Check Enable OEM Unlock
Spoiler: Enable OEM Unlock
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Boot you phone into EDL
You can make sure that your phone is in EDL by plugging your phone to your pc and checking the Device Manager > Ports > Qualcom HS-USB QDLoader 9008 (COM#)
Spoiler: Device Manager
Hold Vol- and Power, when the phone screen turns off to restart begin quickly pressing the vol+ but keep holding vol- and power.
Here is a youtube video of how to boot to EDL:
Spoiler: How to enable EDL mode (Как включить режим EDL 9008) on LG G7 G8 V30 V35 V40 V50
Open QFIL, Select your Phone's Port, Select Flat Build under Select Build Type, Select the Firehose.elf file under Select Programmer, on the bottom right of QFIL select UFS as the Storage Type.
Spoiler: QFIL setup
Click Tools > Partition Manager.
Find Abl_a and right click on it and select Manage Partition Data. Click Read to backup your abl_a.
Spoiler: Right Click - Manage Partition Data
Go to Windows Explorer and go to C:\Users\Username\AppData\Roaming\Qualcomm\QFIL\COMPORT#
Rename your ReadData_ufs_Lun4.bin to abl_a.bin
Spoiler: Before Rename abl_a and abl_b
Do the same with abl_b, boot_a, and boot_b.
Boot_a and Boot_b is for Magisk Root. Skip if you only want Bootloader Unlock.
Spoiler: After Rename abl_a and abl_b
Close Partition Manager. Your phone will reboot to EDL on its own after pressing OK. Wait on that.
Go back to Partition Manager and right click on abl_a again then select Manage Partition Data, then Select Load and choose the abl engineering file.
Do the same for abl_b.
Close Partition Manager. Your phone will reboot to EDL on its own after pressing OK. Wait on that.
Reboot to Fastboot. Hold Vol- and Power then release power when reboot starts and keep holding vol-
If that doesn't work unplug and Power off your phone. Hold vol- and plug it in. It should go into fastboot.
Once your phone is in Fastboot it should say
Device State: Locked and Active A/B Slot - _a or _b
remember whichever slot your device says and stay on that slot, you may risk bricking if you change to the other slot. You also need this for Root later.
Spoiler: Bootloader Locked and Slot
Extract the ADB.zip
open a Command Prompt and change the directory to the adb folder you just extracted
cd C:\adb
run fastboot devices in that command prompt. it should show "LMG850UM fastboot"
Move the backed up abl_a.bin and abl_b.bin to the adb folder, also frp_verizon.img if you have the verizon LG G8.
Spoiler: Move abl_a.bin, abl_b.bin to ADB folder. frp_verizon.img as well for Verizon Variant
Verizon LG G8 only: Run fastboot flash frp frp_verizon.img then fastboot reboot-bootloader
Reboot to Fastboot. Hold Vol- and Power then release power when reboot starts and keep holding vol-
If that doesn't work unplug and Power off your phone. Hold vol- and plug it in. It should go into fastboot.
Run fastboot oem unlock
Select Unlock The Bootloader with your arrow keys and press the Power Button
Spoiler: Bootloader Unlock with Volume Keys
Reboot back to the Bootloader. Unplug your phone, Power off, Hold Vol-, then Plug it in.
Your phone should say Device State – unlocked now
Spoiler: Success Bootloader Unlock
Now fastboot flash abl_a abl_a.bin
and fastboot flash abl_b abl_b.bin
Finish with fastboot reboot
Your Phone Is now Bootloader Unlocked.
Magisk Root
Only do this after you have followed the above guide and have Unlocked your Bootloader.
Magisk
Xda Forum: https://forum.xda-developers.com/f/magisk.5903/
Xda Thread: https://forum.xda-developers.com/t/magisk-the-magic-mask-for-android.3473445/
Github Page: https://github.com/topjohnwu/Magisk
Find the slot you are on from the fastboot bootloader earlier
Go to Windows Explorer and go to C:\Users\Username\AppData\Roaming\Qualcomm\QFIL\COMPORT#
Transfer to your phone the boot_a.bin or boot_b.bin that you backed up in the COMPORT# folder.
Download and install Magisk Manager.
Open Magisk Manager and beside Magisk hit "Install" then "Select and Patch a File" and select the boot_a.bin or boot_b.bin.
After Magisk has patched your boot img you should have magisk_patched#####.img in your phones Download folder.
Transfer it to your PC.
Reboot to EDL
Open QFIL. Click Tools > Partition Manager.
Find the slot you are on from the fastboot bootloader earlier and right click on either boot_a or boot_b and select Manage Partition Data.
Click Load and select the magisk_patched#####.img file you transfered from your phone.
Wait for it to finish then Close Partition Manager. Your phone will reboot to EDL on its own after pressing OK. Wait on that.
Reboot to System by holding vol- and power till your phone reboots out of EDL then release both.
Your phone is now Bootloader Unlocked with Magisk Root.
Hopefully this helps.
This guide was written by me, but the information was provided by Cloud1250000.
If there are any errors let me know and I will fix.

Does this work on sprint lg g8x

It should since the abl used is from a g8x and it worked on my v50 sprint..

¿Alguien ya ha probado si es estable es root? ¿O se elimina después de cada reinicio?

RenardHCRc said:
¿Alguien ya ha probado si es estable es root? ¿O se elimina después de cada reinicio?
Click to expand...
Click to collapse
use google translator next time.
"
Has anyone already tested if root is stable? Or is it removed after every reboot?
"
yes it stays after reboot.. you basically root the normal way.. by patching boot.. because you unlock the bootloader before that.

cloud1250000 said:
use google translator next time.
"
Has anyone already tested if root is stable? Or is it removed after every reboot?
"
yes it stays after reboot.. you basically root the normal way.. by patching boot.. because you unlock the bootloader before that.
Click to expand...
Click to collapse
Okey Arigato

worked on korean v50 (v500n)
for qfil to work, I had to use windows server 2019. linux should work too. i had errors on both my main machine and my laptop, both of which are running win 10 pro
for fastboot to work, I had to enable testmode (requires you to turn off secure boot in your uefi)
thanks to cloud1250000 for helping me through the process

why my phone has lost touch
what can i do

anhtuan70000 said:
why my phone has lost touch
what can i do
Click to expand...
Click to collapse
Phone model? Firmware?
Did you restore the abl_a and abl_b with the backup you made?
It losts touch at what step in the guide?

cloud1250000 said:
Phone model? Firmware?
Did you restore the abl_a and abl_b with the backup you made?
It losts touch at what step in the guide?
Click to expand...
Click to collapse
thanks for reply
my devices: lg g8 sprint g820u21d
i think i solved it, just restore the abl_a and abl_b but my device doesnt have root. i follow magisk root step , try many time but no luck.
edit: Finally i dit it !!

anhtuan70000 said:
thanks for reply
my devices: lg g8 sprint g820u21d
i think i solved it, just restore the abl_a and abl_b but my device doesnt have root. i follow magisk root step , try many time but no luck.
edit: Finally i dit it !!
Click to expand...
Click to collapse
Yeah who would have thought it was important to follow all the steps...

Will this work with T-Mobile G8?

Hi!
I have an LG G8 from Amazon ( Open US?) .
I need root to update the VowiFi operators in the LG files to use VoWiFi in Europe.
I guess i need root and verity disabled?
It's still on Android 9 and i want it on Android 9.
It's there any way to use your guide and still be on Android 9?
Any tips about my goal would be appreciated!

I know it says that Android 10 is required but will this work with Android 9 on G8 G820UM? I have a AT&T G8 that is stuck on Android 9. I tried to manually flash a Android 10 KDZ via modified LG UP but it gets stuck on LG Logo so I flashed an Android 9 KDZ and the phone works fine (the serial # was wiped unfortunately :-(). It obviously doesn't get any OTA updates either. I am wondering if there is any that I can update the phone manually to Android 10.

memnon79 said:
Will this work with T-Mobile G8?
Click to expand...
Click to collapse
Should work

Great, excellent, wonderfull

wwechampian said:
I know it says that Android 10 is required but will this work with Android 9 on G8 G820UM? I have a AT&T G8 that is stuck on Android 9. I tried to manually flash a Android 10 KDZ via modified LG UP but it gets stuck on LG Logo so I flashed an Android 9 KDZ and the phone works fine (the serial # was wiped unfortunately :-(). It obviously doesn't get any OTA updates either. I am wondering if there is any that I can update the phone manually to Android 10.
Click to expand...
Click to collapse
It is upgradable to android 10

The Google Drive link for the LG Mobile Driver was taken down

I'm working with Sprint g8 Thinq LM-G820UMKIT on Android 10. Every time i go to Partition Manager it starts connecting to my phone and sits for about a minute then it come back with an error saying "DownloadFail:Sahara Fail:QSharaServerFailProcess fail".
Its on Flat build
Its has the right programmer path set to the firehose file
and it is set to ufs storage type
Any suggestions?

Tugboat Tony said:
I'm working with Sprint g8 Thinq LM-G820UMKIT on Android 10. Every time i go to Partition Manager it starts connecting to my phone and sits for about a minute then it come back with an error saying "DownloadFail:Sahara Fail:QSharaServerFailProcess fail".
Its on Flat build
Its has the right programmer path set to the firehose file
and it is set to ufs storage type
Any suggestions?
Click to expand...
Click to collapse
You need to unistall QFIL and instal other version until you can, what version of firmware have your phone?

Related

HELP! I can boot into DOWNLOAD mode only, how to re-flash to oero?

STORY: My TA-1004 autoupdate to Android Pie on 22Dec after I turn off my phone to charge battery.
and I follow this " https://forum.xda-developers.com/nokia-8/development/android-9-0-pie-patched-boot-img-t3875977 " to try flash "fastboot flash boot "NB-01-551-b05-Magisk-TWRP" for flash TWRP and magisk to my TA-1004 pie. and I stuck on "nokia logo" after flash, someone said "Factory reset" , I try to use "wipe>format data" in TWRP, until now, I can boot in to download mode only.
I also try this "https://forum.xda-developers.com/nokia-8/how-to/guide-restore-nokia-to-stock-t3867646 "
to restore to oreo and stuck on "Next is greyed out, click on "Edit Phone Information", you will get an error message after a while, clik on OK, BUT Next is still greyed" . Can anyone help me please?
Please check that you have the correct fastboot drivers installed. Open Windows Device manager, and check the properties of your Fastboot device. Do you see HMD Global as the manufacturer? If not, the drivers may not be correct and you should install the Nokia drivers.
singhnsk said:
Please check that you have the correct fastboot drivers installed. Open Windows Device manager, and check the properties of your Fastboot device. Do you see HMD Global as the manufacturer? If not, the drivers may not be correct and you should install the Nokia drivers.
Click to expand...
Click to collapse
thx for reply first,
I can check "Fastboot Device" in Windows Device manager , HMD Global as the manufacturer.
I can check "fastboot devices" by adb/fastboot.exe
kelvin31 said:
thx for reply first,
I can check "Fastboot Device" in Windows Device manager , HMD Global as the manufacturer.
I can check "fastboot devices" by adb/fastboot.exe
Click to expand...
Click to collapse
It should work in that case. Give a try to the NOST tool shared in the Nokia 8 forums itself.
singhnsk said:
It should work in that case. Give a try to the NOST tool shared in the Nokia 8 forums itself.
Click to expand...
Click to collapse
NOST is it means Nokia OST (Online Service Tool) latest version and I need download android pie rom first?
kelvin31 said:
NOST is it means Nokia OST (Online Service Tool) latest version and I need download android pie rom first?
Click to expand...
Click to collapse
NOST" - short for "No Service Tool"
https://forum.xda-developers.com/no...t-improved-version-ost-la-6-0-4-v0-4-t3875574
You should use the existing NB0 which you have for the Nokia 8. I think it is on Oreo only. I hope you do have it.
singhnsk said:
It should work in that case. Give a try to the NOST tool shared in the Nokia 8 forums itself.
Click to expand...
Click to collapse
singhnsk said:
NOST" - short for "No Service Tool"
https://forum.xda-developers.com/no...t-improved-version-ost-la-6-0-4-v0-4-t3875574
You should use the existing NB0 which you have for the Nokia 8. I think it is on Oreo only. I hope you do have it.
Click to expand...
Click to collapse
THx
let me study it first,
thank you very much
singhnsk said:
NOST" - short for "No Service Tool"
https://forum.xda-developers.com/no...t-improved-version-ost-la-6-0-4-v0-4-t3875574
You should use the existing NB0 which you have for the Nokia 8. I think it is on Oreo only. I hope you do have it.
Click to expand...
Click to collapse
hello, I m stuck on unlock_critical, do you have any idea?
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
kelvin31 said:
hello, I m stuck on unlock_critical, do you have any idea?
Click to expand...
Click to collapse
You need to be flashing the actual unlock.bin file you used to unlock the Nokia 8. As you see in your CMD window, the command did not work out.
Make sure you're CMDing in the directory of your unlock file. Then send the command
Code:
fastboot flash unlock UnlockFile.bin
Remember to replace UnlockFile.bin with the name of actual unlock file in your PC.
singhnsk said:
You need to be flashing the actual unlock.bin file you used to unlock the Nokia 8. As you see in your CMD window, the command did not work out.
Make sure you're CMDing in the directory of your unlock file. Then send the command
Code:
fastboot flash unlock UnlockFile.bin
Remember to replace UnlockFile.bin with the name of actual unlock file in your PC.
Click to expand...
Click to collapse
unlock.bin is it provide by HMD that one?
I have receive my nokia 8 unlock bootloader file before by HMD,
name called unlock.key
is it this one? should I rename it to unlock.bin ?
thank you
kelvin31 said:
You need to be flashing the actual unlock.bin file you used to unlock the Nokia 8. As you see in your CMD window, the command did not work out.
Make sure you're CMDing in the directory of your unlock file. Then send the command
unlock.bin is it provide by HMD that one?
I have receive my nokia 8 unlock bootloader file before by HMD,
name called unlock.key
is it this one? should I rename it to unlock.bin ?
thank you
Click to expand...
Click to collapse
Yes, that's the one. You don't have to rename it. Just pass it the way you did earlier.
fastboot flash unlock unlock.key
When it gets accepted, then run:
fastboot flashing unlock_critical
singhnsk said:
Yes, that's the one. You don't have to rename it. Just pass it the way you did earlier.
fastboot flash unlock unlock.key
When it gets accepted, then run:
fastboot flashing unlock_critical
Click to expand...
Click to collapse
its work,
I need to flash unlock.key again even I unlocked my bootloader in september.
but I need flash again after auto update..
I also fastboot flashing unlock_critical, work too.
but got another problem.....
NOST tool error code: 0xa24b
ERROR= BATTERY_VOLTAGE_TOO_LOW_FAIL (0xA24B).
I can't charge or very very slow maybe.
I charge it over 1 hour still lower than NOST tool requirement(30%)...
my TA-1004 can not power off since first flash fail....
I keep saw "download mode" over light and I can't power off...
I did try volup + power, it turn off 2 sec and auto start again boot into download mode...
how can I force power off it?
thank you
kelvin31 said:
its work,
I need to flash unlock.key again even I unlocked my bootloader in september.
but I need flash again after auto update..
I also fastboot flashing unlock_critical, work too.
but got another problem.....
NOST tool error code: 0xa24b
ERROR= BATTERY_VOLTAGE_TOO_LOW_FAIL (0xA24B).
I can't charge or very very slow maybe.
I charge it over 1 hour still lower than NOST tool requirement(30%)...
my TA-1004 can not power off since first flash fail....
I keep saw "download mode" over light and I can't power off...
I did try volup + power, it turn off 2 sec and auto start again boot into download mode...
how can I force power off it?
thank you
Click to expand...
Click to collapse
You can power off the phone from the stock recovery or TWRP. That is, if you are able to boot into any of them. If you have the stock recovery file, then flash it to the phone. After that force reboot it and continue to hold the keys and it should go into recovery mode. The phone will essentially start faster in recovery mode. Or you can also choose the "Power off" option in recovery to power off the phone.
If you cannot get into recovery, then you cannot power it off. And in that case you will have to bear this slow charge only. Just plug it into a wall charger and leave it for a few hours. You can then check the battery capacity after connecting to the PC and sending the following command:
Code:
fastboot oem battery getcapacity
Start NOST and flash the phone if it is higher than the required
singhnsk said:
You can power off the phone from the stock recovery or TWRP. That is, if you are able to boot into any of them. If you have the stock recovery file, then flash it to the phone. After that force reboot it and continue to hold the keys and it should go into recovery mode. The phone will essentially start faster in recovery mode. Or you can also choose the "Power off" option in recovery to power off the phone.
If you cannot get into recovery, then you cannot power it off. And in that case you will have to bear this slow charge only. Just plug it into a wall charger and leave it for a few hours. You can then check the battery capacity after connecting to the PC and sending the following command:
Code:
fastboot oem battery getcapacity
Start NOST and flash the phone if it is higher than the required
Click to expand...
Click to collapse
THanks for help.
I charge it over 10 hrs, I did, I can flash NB1-488B Oreo 8.1 back, I can use my phone right now, thank you very much

Delete This!

Delete This Please!
Go here instead: https://forum.xda-developers.com/lg-v40/how-to/guide-lgup-root-t3967858
Can I Crossflash my LG V40 sprint to be used with an unlocked rom so it can be used in a different company with this method or just install android 9 but it will stay sim locked?
Michaeljror said:
Can I Crossflash my LG V40 sprint to be used with an unlocked rom so it can be used in a different company with this method or just install android 9 but it will stay sim locked?
Click to expand...
Click to collapse
No. Keep reading the forum.
If your device is sim locked by Sprint, the only way currently is to call Sprint and have them unlock it. No, this will not sim unlock your phone. I'm gonna put this in the OP.
Why not replace laf with the dd command?
AFAIK V40 on android 9 can be flashed with lgup by default, without any LAF manipulations.
Only android 8 is problem, need to be flashed to 9 with octoplus
Dump mode does not work.
Xsavi said:
Requirements:
Bootloader Unlocked V40 with V35 eng bootloader in slot B, or A if on Oreo
USB 2.0
Root (For wiping your LAF_a to access fastboot)
My laf Partition (Already Provided)
LGUP and Modded DLLs (Provided in attachment)​
Notes: When you're finished with this, you'll be able to use LGUP 1.14 with no issues. For some odd reason, my V40 has a laf protocol version of 08, instead of 16. So that means LGUP works. This works on all V40s with the exception of T-Mobile's V40.
Okay, lets's get started.
Download The FIles: Google Drive
Installing LGUP:​1. Extract the zip file anywhere on your computer
2. Install LGUP and replace the files located in the "FilesToReplace" folder.
LGUP.exe goes in:
Code:
C:\Program Files (x86)\LG Electronics\LGUP
LGUP_common.dll goes in (If common folder isn't there, create it):
Code:
C:\Program Files (x86)\LG Electronics\LGUP\model\common
Flashing my LAF​Okay, now, you'll need to be in the V35 engineering fastboot for this part.
1.Put your phone in fastboot mode (Power off, vol up, plug in). If you need to access fastboot mode (assuming you're rooted), dd /dev/zero your LAF_a partition (dd if=/dev/zero of=/dev/block/sde16). If on oreo, just power off and hold vol down.
2. Within the extracted ZIP, go into the LGUPCompatibleLAF folder and open a command prompt there (Type CMD in the address bar). We need to get into the V35 Engineering bootloader, run this command:
Code:
fastboot.exe set_active b
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
3. Reboot, and it should boot straight into the v35 eng for pie users. For oreo users, power off, hold vol down, plug in. Run these commands to flash my laf:
Code:
fastboot.exe flash laf_a laf.img
Code:
fastboot.exe flash laf_b laf.img
4. Now, we need to get back to our A slot, run:
Code:
fastboot.exe set_active a
5. Unplug and power off your device. Then, press and hold vol up and plug in your device. You should be in download mode and LGUP will work.
Some Advice:
Do NOT refurbish your device with LGUP. You WILL lose root and your unlocked bootloader. If you ever want to switch firmwares, just use Partition DL. If you use Partition DL, deselect: laf_a, laf_b, abl_b.
You may now flash the KDZ of your choice as long as it's compatible with your V40. Again, I highly recommend using Partition DL when flashing KDZs
Bootloader Unlocking
If you need your bootloader unlocked, or need to recover from a brick, head over to @vbenkovskyy on Telegram. He's an amazing dude and goes above and beyond when unlocking/flashing your device. His prices are amazing too and he'll work with ya (Be reasonable though). The reason I'm putting this in here is because he really helped me out on making these things possible (I bricked several times).
Again, head over to @vbenkovskyy on Telegram if you want your bootloader unlocked.​
Click to expand...
Click to collapse
This worked awesome, LGUP now works.:good:. Thank you. The only problem is not I can't get into FASTBOOT, only DOWNLOAD mode.
I followed this on my Sprint V40. After powering off and trying to enter download mode, I get "Your device has failed a routine safety check and will not boot."
Has anyone seen that before? After that, I get a green screen with black text that says "LGE Crash Handler : FIQ : NOC Error!"
Any ideas?
imekul said:
I followed this on my Sprint V40. After powering off and trying to enter download mode, I get "Your device has failed a routine safety check and will not boot."
Has anyone seen that before? After that, I get a green screen with black text that says "LGE Crash Handler : FIQ : NOC Error!"
Any ideas?
Click to expand...
Click to collapse
did the screen say Sahara?
Yeah, it said Sahara at the very bottom.
imekul said:
Yeah, it said Sahara at the very bottom.
Click to expand...
Click to collapse
I've gotten that a few times lol basically a few things aren't matching and it won't boot correctly, so therefore Sahara
Glad I'm not the only one!
Any idea how I can get out of it?
imekul said:
Glad I'm not the only one!
Any idea how I can get out of it?
Click to expand...
Click to collapse
You can try a few things
1st. fastboot mode and if it's v35 you can flash almost everything from Slot_b
2nd. try to enter download mode and see what happens if you enter Fastboot mode instead then you have the V40 Fastboot in that Slot.
3rd. wait for my Guide.
Ainz_Ooal_Gown said:
You can try a few things
1st. fastboot mode and if it's v35 you can flash almost everything from Slot_b
2nd. try to enter download mode and see what happens if you enter Fastboot mode instead then you have the V40 Fastboot in that Slot.
3rd. wait for my Guide.
Click to expand...
Click to collapse
For #1, do you mean use the fastboot.exe set_active b command and then try flashing with LG UP?
For #2, when I go to download mode it only stays at download for a few seconds before going to that screen with the green text and "Sahara" at the bottom. How do I enter fastboot from download mode?
I appreciate the suggestions!
imekul said:
For #1, do you mean use the fastboot.exe set_active b command and then try flashing with LG UP?
For #2, when I go to download mode it only stays at download for a few seconds before going to that screen with the green text and "Sahara" at the bottom. How do I enter fastboot from download mode?
I appreciate the suggestions!
Click to expand...
Click to collapse
If you have V35 Fastboot (Volume down and power when plugged in) then chances are you may have access to Download Mode, but V40 Fastboot Access so Pie actually boots up takes the place of download mode.
Ainz_Ooal_Gown said:
If you have V35 Fastboot (Volume down and power when plugged in) then chances are you may have access to Download Mode, but V40 Download Mode so that Pie actually boot up takes the place of download mode.
Click to expand...
Click to collapse
I do get the V35 fastboot when I do Vol Down + plug in cable. It says ACTIVE A/B Slot - _a.
Should I do the fastboot.exe set_active b command and then try rebooting into download mode and flashing from LG UP? I was a little confused what the next step would be if I could get the V40 into the V35 fastboot.
imekul said:
I do get the V35 fastboot when I do Vol Down + plug in cable. It says ACTIVE A/B Slot - _a.
Should I do the fastboot.exe set_active b command and then try rebooting into download mode and flashing from LG UP? I was a little confused what the next step would be if I could get the V40 into the V35 fastboot.
Click to expand...
Click to collapse
Yes that's exactly what you should do. I have a Sprint V40 and was bootlooping to the V40 fastboot. I followed this post . I uninstalled and deleted all LGUP and ADB programs and files, from previous attempts just to get a clean start. The three links in the post have everything you need except for firmware. Download the US unlocked PIE kdz. A link to the file can be found in the footer/signature of the OP. You're intuition is on point though, so just follow the directions and I'm sure you'll be fine.
thezachman said:
Yes that's exactly what you should do. I have a Sprint V40 and was bootlooping to the V40 fastboot. I followed this post . I uninstalled and deleted all LGUP and ADB programs and files, from previous attempts just to get a clean start. The three links in the post have everything you need except for firmware. Download the US unlocked PIE kdz. A link to the file can be found in the footer/signature of the OP. You're intuition is on point though, so just follow the directions and I'm sure you'll be fine.
Click to expand...
Click to collapse
Why thanks for clearing that up and pointing them in the right direction, cheers
Just info to maybe clear confusion for some who is in a whirlwind (like me)
I've been bouncing between forums for a good few hours. I'm confused on what this one is forum is for (international v40s?) as I was able to Use LGUP on my Sprint V40 that was running 8.1 and flashed it to US unlocked kdz 9.0 (Pie?) without having my bootloader unlocked and not rooted (well i was never able to get into bootloader/fastboot to OEM unlock it).
but i do have a question, from what i gathered between all the sources i read... I need to contact someone to obtain the 35v engineering bootloader and flash to my device, so i have a bootloader that i can boot into for fastboot?
Im just trying to get TWRP but i have no bootloader or does not load with adb, volume down + power when plug in cable methods.

[GUIDE] Unlock your LG V40 via 9008 mode (Every Variant except T-Mobile)

This Guide will explain how to unlock your LG V40 (Every variant except T-Mobile)​
Unlock Prerequisites:
Make sure you have "Enable OEM Unlock" enabled in developer options, along with adb debugging. Very important. You'll be stuck with the red triangle otherwise. If you don't have the "Enable OEM Unlock" option in developer options, you'll have to flash frp with the v35 engineering bootloader. The frp image will be provided in the attachments section.
QPST Download:
It turns out the reason QFIL is failing is because it's missing quite a bit of stuff. I'm providing the zip to QPST (It's actually required) to install. QPST includes QFIL. My fault, I'm all over the place with this... Here it is (GDrive): QPST
Booting into EDL:
Note: This can be done while booted!
1. Plug in your Phone to your PC
2. Press and hold Power and Volume Down
3. As soon as your screen blanks, rapidly start pressing volume up.
4. If you've successfully booted into EDL, your screen will be completely blank and the device manager will show (Under COM Ports): Qualcomm HS-USB QDLoader 9008
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Using QFIL to Unlock Your Bootloader
QPST should be installed, and your in 9008 plugged into your PC.
Setting up QFIL:
1. Launch QFIL and set your storage type to UFS. This is located at the bottom right corner of the window The LG V40 has UFS storage. The leaked loader is a loader for LG SD845 UFS devices. If you try to send the loader with your storage set to emmc, it will NOT work. By default, it is set to emmc.
2. Select the port. Click select port and select the one that says "Qualcomm HS-USB QDLoader 9008 (COM #)" That is your phone. After it is highlighted, press OK.
3. Under select programmer, click browse, find the loader and select it.
4. Your screen should now look like this (Minus the Flat Build Stuff, that is for total unbrick purposes):
QFIL is now all setup and ready for flashing.
Flashing the Engineering Bootloader
1. In the upper left hand corner of the Window, click on Tools > Partition Manager from the drop down menu
2. When the Partition Manager window comes up, find "abl_a" > click on it > right click and select Manage Partition Data.
3. When the "Raw Data Manager" window comes up, there are four options to choose from (I'll tell you what each of them does):
Erase: Wipes the specified partition clean
Read Data...: Backs up the partition. It will tell you where it saved it in the log output in the main window
Load Image: Flashes a .img file of your choice to the specified partition
Close: Brings you back to the Partition Manager
You'll be using the load image function to flash the V35 Engineering bootloader to your device.
4. Click load image then select the V35 engineering bootloader. It will flash the image to your device.
Unlocking Your Device:
Now that the V35 Engineering Bootloader has been flashed to your device:
1. Press and hold the Power and Volume Down buttons until your device reboots out of 9008. When you hear the disconnect sound, immediately hold volume down (only volume down) to enter fastboot right away (this is required for both methods, my apologies).
2. When you've entered fastboot, execute this command:
Code:
fastboot oem unlock
Userdata will be wiped as a security measure as with all android devices.
3. While you're still in the v35 engineering bootloader flash back the stock pie bootloader (If originally on pie firmware) with:
Code:
fastboot flash abl_a path/to/ablpiestock.img
The V35 Engineering bootloader is OREO only. Some people have managed to boot with this on pie firmware. But generally, you WON'T be able to boot with this flashed if you're on PIE firmware. If you're on Oreo firmware, you can leave this flashed
4. For devices without the "Enable OEM Unlock" option, you'll need to flash frp! You can do so with (While still in V35 Bootloader):
Code:
fastboot flash frp path/to/frp
4a. Reboot right back into fastboot (hold volume down after rebooting) and run:
Code:
fastboot oem unlock
The reason you can't unlock your T-Mobile device is because no other bootloader/firmware will work with T-Mobile devices. Only T-Mobile firmware will work on it. If you're looking for root, avoid V405TA (T-Mobile) phones. Any other model will work for this.
For some reason, the status says Download Fail:Fail to find QDLoader port after switch when I try to go to the partition manager.
Crap, I completely forgot an important detail. If you are using 9008 mode for the first time, you'll need to update the driver in Device Manager. Then select the port. My fault, I'll update that now.
It should say: Qualcomm HS-USB QDLoader 9008
Xsavi said:
Crap, I completely forgot an important detail. If you are using 9008 mode for the first time, you'll need to update the driver in Device Manager. Then select the port. My fault, I'll update that now.
It should say: Qualcomm HS-USB QDLoader 9008
Click to expand...
Click to collapse
That would do it???. I'll try doing that
@Xsavi This is Awesome! I might get a V40 later in the year
Btw a small point, the title says: Unlock your LG V40 (Via 9008) Root ONLY for T-Mobile variants.
while guide says: his Guide will explain how to unlock your LG V40 (Every variant except T-Mobile)
Title probably needs to be corrected
tech_infinity said:
@Xsavi This is Awesome! I might get a V40 later in the year
Btw a small point, the title says: Unlock your LG V40 (Via 9008) Root ONLY for T-Mobile variants.
while guide says: his Guide will explain how to unlock your LG V40 (Every variant except T-Mobile)
Title probably needs to be corrected
Click to expand...
Click to collapse
Title and guide has been corrected. Thank you for the much needed suggestion!
Also getting a Download Fail, but mine reads "Download Fail:Sahara Fail:QSaharaServer Failrocess fail". My port is showing as Qualcomm HS-USB QDLoader 9008 (COM7). I was sure to try to update the driver in device manager, and am prompted that "The best drivers for your device are already installed".
toddyskates said:
Also getting a Download Fail, but mine reads "Download Fail:Sahara Fail:QSaharaServer Failrocess fail". My port is showing as Qualcomm HS-USB QDLoader 9008 (COM7). I was sure to try to update the driver in device manager, and am prompted that "The best drivers for your device are already installed".
Click to expand...
Click to collapse
The culprit is QFIL being by itself instead of being installed with QPST.
Is that a full, permanent unlock V30-style? So that means that I could now go ahead and buy a North American LG V40 safely as long as it isn't T-Mobile?
WaseemAlkurdi said:
Is that a full, permanent unlock V30-style? So that means that I could now go ahead and buy a North American LG V40 safely as long as it isn't T-Mobile?
Click to expand...
Click to collapse
With 9008 and this firehose, you have complete access to your phone and can flash anything you want with no restrictions.
As long as it isn't T-Mobile, you're fine. The firehose works on those models, but any other firmware/bootloader won't work, so you can't really unlock on T-Mobile models.
How to enter edl mode?
I can't wait to try this!
I'm holding pwr & - vol until the phone resets. While holding pwr & - vol down, I am tapping + vol. I can't get to the blank screen, the phone just restarts normally. Any advice?
clutterking said:
I can't wait to try this!
I'm holding pwr & - vol until the phone resets. While holding pwr & - vol down, I am tapping + vol. I can't get to the blank screen, the phone just restarts normally. Any advice?
Click to expand...
Click to collapse
You have to start pressing volume up as soon as the screen blanks. It's an extremely small window. It'll take a few tries though. Plug in your device, and as soon as you hear the disconnect sound, start pressing volume up. It helps a little for me.
Confirmed working for Korean model LM-V490N!
Xsavi said:
With 9008 and this firehose, you have complete access to your phone and can flash anything you want with no restrictions.
As long as it isn't T-Mobile, you're fine. The firehose works on those models, but any other firmware/bootloader won't work, so you can't really unlock on T-Mobile models.
Click to expand...
Click to collapse
Awesome! You guys are brilliant!
So do we expect a kickstart in development (like the V30's dev scene) now that an unlock is available for everybody?
And one last question: does this mean that we can unlock a (network) locked phone this way? I know that the usual answer is 'no', but from what I've seen around here, there's something called 'cross-flashing' of US unlocked firmware. Perhaps that means an unlock?
If not, do online unlock services work? (I do not want any names - I just want to know whether any service at all works).
I do apologize if my questions are stupid - it's only that with the overwhelming amount of (sometimes contradictory) posts here, I just want to make sure I'm doing everything correctly! :laugh:
WaseemAlkurdi said:
Awesome! You guys are brilliant!
So do we expect a kickstart in development (like the V30's dev scene) now that an unlock is available for everybody?
And one last question: does this mean that we can unlock a (network) locked phone this way? I know that the usual answer is 'no', but from what I've seen around here, there's something called 'cross-flashing' of US unlocked firmware. Perhaps that means an unlock?
If not, do online unlock services work? (I do not want any names - I just want to know whether any service at all works).
I do apologize if my questions are stupid - it's only that with the overwhelming amount of (sometimes contradictory) posts here, I just want to make sure I'm doing everything correctly! :laugh:
Click to expand...
Click to collapse
Your questions aren't stupid.
Unfortunately, you can't sim unlock using this method. I'm hoping this will kickstart development for this device also, I already have a few ROMs made I have yet to release to XDA. Any 3rd party online unlock services are scams. Nowadays, everything is done server side when it comes to SIM unlocking your phone.
No problem dude! If you have any other questions, feel free to reach out to me. I'm super active in the V40 telegram group. I'm becoming more active here too (I need to. LoL).
Fantastic!!! Really appreciate all the hard work.
Sent from my LM-V405 using Tapatalk
TheLinuxMan02 said:
Note: If on Pie firmware, boot back into 9008 and flash the latest TWRP, along with the stock ABL so you can boot back into your firmware. With the engineering bootloader, you can't boot pie firmware. Only oreo.
Click to expand...
Click to collapse
Hey, thanks so much for this method. A damned shame we got to go through this just to get fastboot on these damn phones, but you're the all-stars we need to get it going.
Question. How are we flashing TWRP and ABL? Using fastboot or QFIL? Also, do you have a link to the latest TWRP? I know there's a thread in this forum for TWRP by SGCMarkus. Is that the TWRP version you recommend?
copota said:
Hey, thanks so much for this method. A damned shame we got to go through this just to get fastboot on these damn phones, but you're the all-stars we need to get it going.
Question. How are we flashing TWRP and ABL? Using fastboot or QFIL? Also, do you have a link to the latest TWRP? I know there's a thread in this forum for TWRP by SGCMarkus. Is that the TWRP version you recommend?
Click to expand...
Click to collapse
You can use either method to flash twrp and abl. If in QFIL, just follow the steps above but choose boot_a or boot_b for TWRP, and abl_a and abl_b for stock abl.
I can't get my phone into 9008 mode. Would it be because I crossflashed my phone? Here's my crossflashing history...
edit: Never mind, when I plugged my phone into a power source, then tried it, I was able to get into 9008 mode.
Is this something that could be blocked in a further update? Is there something LG could do to block it?
Thanks again

How To Guide Unlock bootloader in 1sec and root (magisk) without custom recovery

May not work for all devices, use at your own risk​Preparation​We are going to do it on Windows, if you use Mac or Linux, please read the corresponding tutorial here.
First of all you should install Magisk 24.1+ and patch boot.img through magisk app. Then copy the patched img file to your PC, it will be used soon.
Now follow the steps:
1. Install python(3.9 recommended) and git.
2. Clone the repository and install the dependencies:
Code:
git clone https://github.com/bkerler/mtkclient.git
cd mtkclient
pip install -r requirements.txt
3. Install UsbDk x64.
4. Turn off your phone and connect your phone to pc with usb cable.
5. Run command python mtk_gui in CMD or Powershell, make sure to locate to mtkclient directory before you run command.
6. Now hold volume down + power button till you see phone detected in the GUI or CMD/Powershell. Then you could release the buttons.
After the device info initialized you can see:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
​Now let's unlock bootloader:​If you have unlocked just skip and go to magisk root tutorial at the last.
Go to Flash Tools , you can see Unlock bootloader , click it. Your phone would be unlocked in 1sec.
You will getting a dm-verity warn when booting, just press the power button to continue. This warn could disappear by clean flash a ROM.
It's RECOMMENDED to do a clean flash after unlock, using MiFlash (Do not lock again). Then install Magisk and root your phone.
Now let's root the phone:
1. Rename your patched boot image to xxxx.bin, for example: magisk_patched_boot.img -> magisk_patched_boot.bin
2. Go to Write Partitions
3. Find boot_a and boot_b, set both of their values to the path of magisk_patched_boot.bin
4. Click Write Partitions button at the top right.
5. Wait until the progress goes to 100%.
6. Close the window, disconnect the phone. Long press power button to reboot.
If you did everything correctly and it still boot loop, try to use mtkclient to read boot_a partition, then patch it and flash it.
Now your phone should boot successfully with magisk root.
The big question now is should people wait for MIUI 13? New update may include new drivers and kernel. The rooting and or breaking checksums may break the OTA updates?
will it work on evergo?
in the picture it show dimensity 700 5g.
And can i unlock bootloader by fastboot?
Im in loop with fastboot.
thaw26 said:
will it work on evergo?
in the picture it show dimensity 700 5g.
And can i unlock bootloader by fastboot?
Im in loop with fastboot.
Click to expand...
Click to collapse
works. You can use the tool to unlock bl
doesnt work for Mi Note 11T. Cant unlock bootloader.
Hello. I'm following all the steps in order to unlock my Poco M4 Pro 5G. Apparently it unlocks, but when I switch ON my phone it is still locked.
I attach two files with the screen before and after pushing "unlock".
Can Anybody Help me?
jcabad66 said:
Hello. I'm following all the steps in order to unlock my Poco M4 Pro 5G. Apparently it unlocks, but when I switch ON my phone it is still locked.
I attach two files with the screen before and after pushing "unlock".
Can Anybody Help me?
Click to expand...
Click to collapse
it's kind of weird, some users could unlock and for some users this method doesn't work.
Good work, mate! Also work at Redmi Note 8 pro.
I'm finish almost in 5 min..
jcabad66 said:
Hello. I'm following all the steps in order to unlock my Poco M4 Pro 5G. Apparently it unlocks, but when I switch ON my phone it is still locked.
I attach two files with the screen before and after pushing "unlock".
Can Anybody Help me?
Click to expand...
Click to collapse
Having the same issue here. The bootloader seems to be just locking back when booting into System. Tried everything, nothing helps. Tried to unlock bootloader with MiFlashUnlock, got "Failed to unlock (-1)" error. I just dont know what I can do now.
I done everything but my phone doesn't unlock so now I have the dm-verity warning and I can't do a clean flash with Miflash. Also Miflash Unlock doesn't work. What I can do now?
miaochenxi said:
Preparation​We are going to do it on Windows, if you use Mac or Linux, please read the corresponding tutorial here.
First of all you should install Magisk 24.1+ and patch boot.img through magisk app. Then copy the patched img file to your PC, it will be used soon.
Now follow the steps:
1. Install python(3.9 recommended) and git.
2. Clone the repository and install the dependencies:
Code:
git clone https://github.com/bkerler/mtkclient.git
cd mtkclient
pip install -r requirements.txt
3. Install UsbDk x64.
4. Turn off your phone and connect your phone to pc with usb cable.
5. Run command python mtk_gui in CMD or Powershell, make sure to locate to mtkclient directory before you run command.
6. Now hold volume down + power button till you see phone detected in the GUI or CMD/Powershell. Then you could release the buttons.
After the device info initialized you can see:
View attachment 5522315
​Now let's unlock bootloader:​If you have unlocked just skip and go to magisk root tutorial at the last.
Go to Flash Tools , you can see Unlock bootloader , click it. Your phone would be unlocked in 1sec.
You will getting a dm-verity warn when booting, just press the power button to continue. This warn could disappear by clean flash a ROM.
It's RECOMMENDED to do a clean flash after unlock, using MiFlash (Do not lock again). Then install Magisk and root your phone.
Now let's root the phone:
1. Rename your patched boot image to xxxx.bin, for example: magisk_patched_boot.img -> magisk_patched_boot.bin
2. Go to Write Partitions
3. Find boot_a and boot_b, set both of their values to the path of magisk_patched_boot.bin
4. Click Write Partitions button at the top right.
5. Wait until the progress goes to 100%.
6. Close the window, disconnect the phone. Long press power button to reboot.
If you did everything correctly and it still boot loop, try to use mtkclient to read boot_a partition, then patch it and flash it.
Now your phone should boot successfully with magisk root.
Click to expand...
Click to collapse
I done everything but my phone doesn't unlock so now I have the dm-verity warning and I can't do a clean flash with Miflash. Also Miflash Unlock doesn't work. What I can do now?
Seeing all the comments. I regret buying MTK chipset and should've stayed snapdragon which has more support. My heart goes out to all those bricked and unable to root
Great! It works.
Redmi Note 11 5G Chinese rom MIUI12.5.4 stable version.
magisk alpha 24301, the boot.img , install magisk , patch the boot.img
Using the tools 残芯专用TWRPRecovery刷入工具Win版V2.1.exe in the link . to flash.
The system can be rw.
madagascar.zebra said:
Great! It works.
Redmi Note 11 5G Chinese rom MIUI12.5.4 stable version.
magisk alpha 24301, the boot.img , install magisk , patch the boot.img
Using the tools 残芯专用TWRPRecovery刷入工具Win版V2.1.exe in the link . to flash.
The system can be rw.
View attachment 5561677View attachment 5561679View attachment 5561681View attachment 5561683
Click to expand...
Click to collapse
That seems interesting. Man, can you please make a full tutorial how to root the phone with this "残芯专用TWRPRecovery刷入工具Win版V2.1.exe"? I just don't know Chinese. Also, your link seems to be broken, I cannot open it.
hi
I bought the POCO M4 Pro 5G and tried this tool.
I also couldn't unlock the bootloader with this tool.
After that, the dm-verity warning came to be displayed.
However, I was able to unlock it with the official miflash unlock tool after 168 hours.
I think the person who got the error with the official tool is due to another factor.
Thanks, your method worked perfectly
I've got the problem were I can't unlock. Tried all methods from MIUI official to mtkclient. Says unlocks but MIUI says still locked. Also any moded boot_a or boot_b partition converted with Magisk and written back, results in System Destroyed message on boot. Then I have to wrote back official boot.img to get phone working again. Tried on 12.5.3 and on 12.5.7 MIUI. Poco needs to get their act together and offer an automated unlock and root option in development section.
Finally rooted my phone. The problem I had is the bootloader wasn't properly unlocked. mtkclient simply wasn't able to unlock. I used the MIUI Unlock and didn't have to wait due to past registration and failed wait period. To know if your phone is properly unlocked you'll see a padlock with the open bar at the top of the boot screen. Not sure if a mtkclient unlock will also show the unlocked padlock icon.
Thanks for your guide, i just want to confirm that, is safteynet passing on rooted miui v12.5.7? (Global : Poco M4 Pro 5G : Evergreen : 21091116AG)
Здравствуйте столкнулся с такой проблемой я не смог достать Бут файл для моего андроида 13.0.4 на poco m4 pro 5g.
miaochenxi said:
You will getting a dm-verity warn when booting, just press the power button to continue. This warn could disappear by clean flash a ROM.
It's RECOMMENDED to do a clean flash after unlock, using MiFlash (Do not lock again). Then install Magisk and root your phone.
Click to expand...
Click to collapse
Hi, anyone have tried to reflash ROM? error disappear?
stupid question: If I unlock with official xiaomi tool (only if this guide doesn't work for me), can I make the message disappear somehow?
I will receive my redmi note 11s 5g next days

How To Guide [GUIDE] UNBRICK YOUR HARD-BRICKED MTK

MIFLASHPRO PROCEDURE​
The MiFlashPro procedure is easier (and the easiest to recover your hard-bricked device), as you do not require the installation of any other external program (like python used in MTK Client for example (expect, of course, the drivers)
MTK Client is a more complicated installation as it requires the installation of Python and Git, which can be harder to use commands for people that don't or never used Python and Git, but gives you access to lock and unlock your bootloader with no 168 HOURS wait
In general, newer MTK chips are really easy to unbrick, even from a hard-brick, as it does not requires to open your phone and test-point it (especially this forum MTK 6833), compared to Snapdragon chips, which is the opposite and even costs 25€ to have a "Authorized Mi EDL Account". Keeping that out of the way, lets get to it
FIRST OF ALL​Install the MTK Preload/BROM VCOM drivers for your computer to recognise your phone in BROM state and follow the instructions given in the installation. Attached at the end of the thread
And download any MIUI ROM version from any trusted website (my favorite is mifirm.net, it downloads faster)
INSTALL MIFLASHPRO Attached at the end of the thread​There's two different Mi Flash(es). Mi Flash and Mi Flash Pro.
Mi Flash is only used to flash MIUI in your device, nothing special, probably everyone knows about it.
Then theres Mi Flash Pro (MFP for short). It's an All-In-One (AIO) tool, as shown below.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
We got the some tabs, but let's focus on the "Recovery" and "SP Flash" tabs, as we do not need the other ones.
Recovery - Recovery flashing. If your device is only booting to Recovery (which can be possible, since someone here has got a case that couldn't boot to fastboot neither system, only to recovery), by writing both your device IMEI's on the spaces, then clicking "Refurbish" leads to a more advanced factory reset than just wiping your data normally. This can get you out of recovery and go back to MIUI however. If it's not your problem, then follow on.
SP Flash - The famous SP Tool. SP Tool is a easy tool to use, may be confusing at first, but then first time a charm and you can get used to it, easily, or after some times. SP Tool is famous for recovering many MTK devices from hard bricks, and thats what we will use to recover your device.
OPEN SP FLASH UP​
Here you are, greeted by a nice interface. There's nothing, but I will explain you to it.
There's 3 blank spaces, called Download-agent (DA for short), Scatter-loading file & Authentication file.
DA is to have access to the devices internal storage to be able to do the flashing;
Scatter-loading shows you the mapping of the partitions it will flash on the MTK;
Authentication is just the MTK protection for newer mtk devices that you need to be able to flash (*its also used to successfully flash, but you still need to bypass it somehow, as you require a Mi Account able to do BROM flashing, see below as you follow the thread)
Now, fill the blanks up:
To find the DA, it is always in the MiFlashPro installation location, so ...\MiFlashPro\. Access that folder, open up "\SP_Flash_Tool_V5" folder, and you will find a file named "MTK_AllInOne_DA.bin", use it as the DA.
To find the authentication file, its located in the same path of the DA, so ...\MiFlashPro\SP_Flash_Tool_V5\, and you will find a file named "auth_sv5.auth", use it as the authentication file.
Finally, to find the scatter-loading file, it is in the ROM folder you extracted, so ...\camellian_xx_xxxx_images_VXX.X.X.X.xxxxx_XXXXXXXX.XXXX.XX_XX.X_xxxxxl\ (the X's represent your MIUI version you downloaded). The scatter-loading file is always located in the folder "images", so \camellian...\images\, and you will find a text file named "MT6833_Android_scatter.txt", use it as the scatter-loading file.
Done?
Don't flash it yet, as we need to fix a issue with "combo_partisize_check".
Open up the scatter-loading file with Notepad or any text editor, so the text file named "MT6833_Android_scatter.txt".
Now, use the locate function to locate the following:
combo_partsize_check: true
After finding the first one, replace the "true" to "false", and the following one, and so on, till every line of them is set to "false" and isn't able to locate any set as "true".
We are done and finished setting up SP Tool!​*Now, we need to bypass the Authentication of our device. Why? Just as the Snapdragon chips, Xiaomi has also implemented a security layer where you need to log in with a "Authorized Mi Flashing Account", which costs money (generally only on Snapdragon devices, I am not sure if we can find any paying service for it), which is really easy to bypass due to BROM.
Download the file "mtkauthbypass.zip" attached in the thread below.
Extract it, open it up, and it looks like this:
Now, press the "Disable Auth" button, you will have 60 seconds to get ready, get your hands on the phone and press at the same time the VOL+, VOL- & POWER button, till you see prompt appearing in the blank space. Should be similiar as this:
(thanks to chopwell20 for image)
After that, immediately open up SP Tool, and press "Download" as fast as possible.
Let it flash, from 5 to 15 minutes.
After it finishes, a blue window with a checkmark appears, disconnect your phone, and just press down the POWER button to boot it up.
And thats it! You have recovered your phone!​If you have any issues or it didn't work out, please reply so someone can help you out
(Simplified image to understand better without explanation)
ISSUES​CONNECTIONS ISSUE is completely normal!
It is when you try to connect your phone in BROM mode to your computer, but it always shows the error symbol over it.
From what it seems, this should be a issue from the phone and not your computer or the drivers itself
It doesn't mean that it makes you unable to unbrick it, but a lot of patience, as with this issue you will require to keep trying over and over again to bypass it.
So, if you can't bypass the Auth, this is probably it. Just keep trying and trying over again till you get it. There's (probably) no workaround rather than having patience to do it
(This also happens to me every time, so I consider it normal, and with some users such as bg0169 having this same issue, I just considered this was important to address it out, but if you think its not this issue, then reply, better safe than sorry)
I made this thread due to some users bricking their devices, and for every new user that hard-bricks their device to hopefully make this to help them
Amazing guide.
Thanks. and missing screenshot where Authbypass gives you prompt.
SP Flash Tool gives error on "gz.img, rescue.img and cust.img" because verified boot is enabled.
Is it possible to bypass it? or how do i disable verified boot without fastboot access? is my device completely dead?
Reelin said:
SP Flash Tool gives error on "gz.img, rescue.img and cust.img" because verified boot is enabled.
Is it possible to bypass it? or how do i disable verified boot without fastboot access? is my device completely dead?
Click to expand...
Click to collapse
yes, it is bypassable.
you just go to the mapping, and disable the checks on those partitions. it will still boot normally, afterwards, if you want (which is not necessary), you can reflash your phone via fastboot and miflash for those partitions to be flashed correctly
1lopes said:
yes, it is bypassable.
you just go to the mapping, and disable the checks on those partitions. it will still boot normally, afterwards, if you want (which is not necessary), you can reflash your phone via fastboot and miflash for those partitions to be flashed correctly
View attachment 5895435
Click to expand...
Click to collapse
Thanks for your reply.
Unfortunately, my phone won't boot when i exclude those images. No vibration, no black screen and no fastboot/recovery.
The another bypass method which requires using readback also doesn't work. I think it's probably because mt6833 is a newer chipset compared to the ones used in tutorials.
Any other advices please? I really don't want to pay money just to use MIUI again.
Reelin said:
Thanks for your reply.
Unfortunately, my phone won't boot when i exclude those images. No vibration, no black screen and no fastboot/recovery.
The another bypass method which requires using readback also doesn't work. I think it's probably because mt6833 is a newer chipset compared to the ones used in tutorials.
Any other advices please? I really don't want to pay money just to use MIUI again.
Click to expand...
Click to collapse
Could you give me more details about the another bypass? I dont understand what do you mean.
If that did not work, then I suppose your bootloader is locked
Please download the engineering ROM > https://mifirm.net/model/camellian.ttt#files;
and flash it via SP Tool like you did to MIUI, then boot to fastboot and flash an EEA image > https://mifirm.net/model/camellian.ttt#eea (if i am correct, EEA images are allowed to be flashed even with locked bootloader.)
If you do get the same verified boot error, disable those partitions to flash once again
If these methods didnt work, you need to install MTK Client to unlock your bootloader and try to reflash via fastboot or SP Tool
1lopes said:
Could you give me more details about the another bypass? I dont understand what do you mean.
If that did not work, then I suppose your bootloader is locked
Please download the engineering ROM > https://mifirm.net/model/camellian.ttt#files;
and flash it via SP Tool like you did to MIUI, then boot to fastboot and flash an EEA image > https://mifirm.net/model/camellian.ttt#eea (if i am correct, EEA images are allowed to be flashed even with locked bootloader.)
If you do get the same verified boot error, disable those partitions to flash once again
If these methods didnt work, you need to install MTK Client to unlock your bootloader and try to reflash via fastboot or SP Tool
Click to expand...
Click to collapse
My father took my phone and paid to repair it. Well, i guess thats a way to fix things...
Anyway, the other method i was talking about was the one using PGPT image and using Hex editor blah blah blah.
By the way, now my phone works but it seems NVRAM was deleted. My IMEI doesn't show up. Can i recover it without using temporary methods?
Reelin said:
My father took my phone and paid to repair it. Well, i guess thats a way to fix things...
Anyway, the other method i was talking about was the one using PGPT image and using Hex editor blah blah blah.
By the way, now my phone works but it seems NVRAM was deleted. My IMEI doesn't show up. Can i recover it without using temporary methods?
Click to expand...
Click to collapse
I dont know how to recover IMEIs since I always back my NVRAM and write it via MTK Client.
You can try this guide:
Thread '[QUICK GUIDE][HOW TO] Unbrick Camellia/Camellian and restore IMEI' https://forum.xda-developers.com/t/quick-guide-how-to-unbrick-camellia-camellian-and-restore-imei.4502077/
Alternatively, which I am not sure, try looking up a IMEI writer program somewhere in the web for MTK
---------- full quote removed ----------
Bro i need help
I followed the process as is, everything went well, I marked the blue box with the checkmark, when I turned on my device it was still the same, what do you recommend I do?
sorry for my bad english, i am using a translator because i am spanish speaking
TheZian said:
Bro i need help
I followed the process as is, everything went well, I marked the blue box with the checkmark, when I turned on my device it was still the same, what do you recommend I do?
sorry for my bad english, i am using a translator because i am spanish speaking
Click to expand...
Click to collapse
That is weird, are you able to boot into recovery or fastboot?
Did you get any verified boot error?
Did you use the right firmware? If so, what version (MIUI version (Indonesia/EEA/MI, etc.), Android version and Codename)? If you used the latest one (MIUI 14 Android 13) please try MIUI 13 Android 12 or lower
Try this:
Post in thread '[SOLVED] RN10 5G Hard-bricked after installing GSI' https://forum.xda-developers.com/t/solved-rn10-5g-hard-bricked-after-installing-gsi.4563191/post-88302451
Esto no debería pasar.
¿Eres capaz de reiniciar en fastboot o recovery?
¿Obtuviste algún error de arranque verificado (verified boot)?
usaste el firmware correcto? si si, cual version (version de la MIUI (Indonesia/EEA/MI...) version de la Android y codename)?
1lopes said:
That is weird, are you able to boot into recovery or fastboot?
Did you get any verified boot error?
Did you use the right firmware? If so, what version (MIUI version (Indonesia/EEA/MI, etc.), Android version and Codename)? If you used the latest one (MIUI 14 Android 13) please try MIUI 13 Android 12 or lower
Try this:
Post in thread '[SOLVED] RN10 5G Hard-bricked after installing GSI' https://forum.xda-developers.com/t/solved-rn10-5g-hard-bricked-after-installing-gsi.4563191/post-88302451
Esto no debería pasar.
¿Eres capaz de reiniciar en fastboot o recovery?
¿Obtuviste algún error de arranque verificado (verified boot)?
usaste el firmware correcto? si si, cual version (version de la MIUI (Indonesia/EEA/MI...) version de la Android y codename)?
Click to expand...
Click to collapse
I use MIUI 12 global version, and can't access fastboot or recovery mode, it didn't give me any error either, and I think I use the correct firmware version.
TheZian said:
I use MIUI 12 global version, and can't access fastboot or recovery mode, it didn't give me any error either, and I think I use the correct firmware version.
Click to expand...
Click to collapse
Try this:
Post in thread '[SOLVED] RN10 5G Hard-bricked after installing GSI' https://forum.xda-developers.com/t/solved-rn10-5g-hard-bricked-after-installing-gsi.4563191/post-88302451
I am unable to use MTK Auth Bypass Tool on my device. It shows an error message 'MTK Auth Disable (SLA/DAA) error!' Can you please help me?
Addendum_expired said:
I am unable to use MTK Auth Bypass Tool on my device. It shows an error message 'MTK Auth Disable (SLA/DAA) error!' Can you please help me?
Click to expand...
Click to collapse
I get the same error, anybody know how to fix?
And there is a "MediaTek Preloader USB VCOM" displayed in the Windows Device Manager.
Reelin said:
SP Flash Tool gives error on "gz.img, rescue.img and cust.img" because verified boot is enabled.
Is it possible to bypass it? or how do i disable verified boot without fastboot access? is my device completely dead?
Click to expand...
Click to collapse
I did have an issue but did not really go through all these stress...I also unbricked it using Brom and my original stock ROM files
Addendum_expired said:
I am unable to use MTK Auth Bypass Tool on my device. It shows an error message 'MTK Auth Disable (SLA/DAA) error!' Can you please help me?
Click to expand...
Click to collapse
Shilze said:
I get the same error, anybody know how to fix?
Click to expand...
Click to collapse
Please try this:
Post in thread '[SOLVED] RN10 5G Hard-bricked after installing GSI' https://forum.xda-developers.com/t/solved-rn10-5g-hard-bricked-after-installing-gsi.4563191/post-88302451
1lopes said:
Please try this:
Post in thread '[SOLVED] RN10 5G Hard-bricked after installing GSI' https://forum.xda-developers.com/t/solved-rn10-5g-hard-bricked-after-installing-gsi.4563191/post-88302451
Click to expand...
Click to collapse
It doesn't work, I think the problem is that the boot mode is bootloader instead of bootrom.
Shilze said:
It doesn't work, I think the problem is that the boot mode is bootloader instead of bootrom.
Click to expand...
Click to collapse
if your phone is displaying the 3 boot modes in the edge, then yes you are in bootloader*
you should restart to any mode, then right as it reboots you shall boot into BROM immediately and redo the same process
I think that when I press the volume up (+), volume down (-), and power buttons on my phone simultaneously, it doesn't seem to recognize any device. However, when I only press the volume up (+) and volume down (-) buttons, it recognizes a MTK Preloader USB VCOM port, and during the process, it seems to attempt to connect twice when "Disable Auth" is enabled. In addition, the BootMode displays as BootLoader

Categories

Resources