Develop Bugs

[OBSOLETE THREAD] Rooting LG G4S (H735)

[OBSOLETE THREAD]
This thread is obsolete. A solution was found, which is posted here:
http://forum.xda-developers.com/g4/help/method-to-root-lg-g4s-model-h735-lg-g4-t3248030
Please use the new thread for discussions.
------------------------
Original thread:
------------------------
Hi,
I have been trying to root the LG G4S (H735), also known as "LG G4 Beat".
I tried two things:
Approach 1
I tried the method posted by konsolen in this thread:
http://forum.xda-developers.com/g4/general/lg-g4s-world-root-lg-devices-t3231759
but it didn't work for me. I tried several times with varying approaches, but the boot process always gets stuck on the LG logo.
Approach 2
I also tried to inject the root as suggested in this thread for the G4:
http://forum.xda-developers.com/g4/help/rooting-lg-h735-g4-beat-t3192491
I've used the Inject_Root_G4.zip from this link, which I believe is the same shared elsewhere:
https://mega.nz/#!BIxUzbqI!nt2YnGnGQlSiBQ-Ar-c-q7oDMIEsg6xd0Kmek-q0clg
And I get the same problem - stuck on the LG logo when booting.
For anyone who wants to reproduce Approach 2 to maybe find a solution:
1. Start up LGFlashTool2014. You can follow instructions in thread by konsolen (see Approach 1 above). You can use his .kdz file as well. Important: Pull out your USB cable as soon as the green letters COMX (with a number instead of X) appear on the phone. My flashtool actually didn't display the progress percentage, but apparently this at 9%. It doesn't matter if you don't see the percentage though, I've verified with this KDZ image that if you pull the cable at the very moment the green letters appear, nothing is corrupted. The phone will still display 0%. Leave it as it is after you unplugged the cable.
2. Kill your flash tool with the windows task manager. After it closed, you can plug the phone back in and open a windows command line in the folder where your Send_Command.exe is (you can download the package in konsolen's instructions which contains Send_Command.exe as well).
3. Open the console to your phone with
Code:
Send_Command.exe \\.\COMX.
(with your number instead of X)
You will have to do steps 1-3 every time you want to get this console, for example to run all the dd commands below.
4. Calculate the dd parameters and backup your system partition into a .img file. There is an excellent guide by dominik-p for how to determine your individual dd parameters:
http://forum.xda-developers.com/g4/help/how-to-determine-dd-parameters-lg-g4-t3184867
5. Keep a copy of your system.img somewhere safe, you can use it to restore your system if something goes wrong. So don't use this original in the next steps!
6. Copy the .img file to a linux system and mount it. I'm guessing who is trying this knows how to do this. Anything you change in the folder you mounted the image on, will be saved in the image. You can then use this updated image to overwrite your original system partition, again with dd (as described in the thread by dominik-p) using your parameters. So here's the crucial bit: You get root access to your system files via linux. When you know the right things to mess with, you can root your phone with the updated image. Injecting the root as done in step 8 is one way to change the system on the G4 in order to root it.
7. [Optional] If you are new to this, you may want to do a simple test before you continue.
Create a testfile (test.txt) on the mounted system partition. Then copy the .img file back to your phone and try to "dd" it back over your system partition.
Then, check if you see the test file on your system partition -- you may have to reboot the phone after the dd command (and log back in with Send_Command.exe) in order to see the updates.
8. Inject root with the Inject_Root_G4.zip on the mounted folder of the image on your linux system. You can follow instructions (Step 2) here:
http://forum.xda-developers.com/g4/general/lg-g4-100-root-success-directives-root-t3180586
9. Copy the new img file to your phone and "dd" it over your system partition, using your own dd parameters.
10. Reboot the phone (you can also just type LEAVE in the Send_Command.exe console).
Now, it should be rooted - if it worked for you!
If it worked for you, that's great. It didn't for me, it got stuck on the LG logo in the boot process again. So I had to write my original system.img back onto my system partition to get the phone back.
I did get the following errors in Step 8 above, though I did try anyway to use the resulting image. The errors may have something to do with my problem, but it may also be because the inject root is for the G4, not the G4s.
Code:
sudo ./autoroot.sh
cp: cannot create regular file ‘operatingtable/lib64/libsupol.so’: No such file or directory
chmod: cannot access ‘operatingtable/lib64/libsupol.so’: No such file or directory
chcon: cannot access ‘operatingtable/lib64/libsupol.so’: No such file or directory
chmod: cannot access ‘operatingtable/bin/app_process64_original’: No such file or directory
chcon: cannot access ‘operatingtable/bin/app_process64_original’: No such file or directory
chmod: cannot access ‘operatingtable/bin/app_process_init’: No such file or directory
chcon: cannot access ‘operatingtable/bin/app_process_init’: No such file or directory
If anyone finds a solution to this, or has any ideas what could be tried, I would be very interested to hear it. I'm new to rooting phones and don't have much experience beyond what I did in the last days.
Cheers
Jennifer

jen.magnolis said:
4. Calculate the dd parameters and backup your system partition into a .img file. There is an excellent guide by @dominik-p for how to determine your individual dd parameters:
http://forum.xda-developers.com/g4/help/how-to-determine-dd-parameters-lg-g4-t3184867
Click to expand...
Click to collapse
Happy that my guide has helped you
As I said here:
http://forum.xda-developers.com/g4/help/rooting-lg-h735-g4-beat-t3192491/page5
Everyone who is interested to inject root must edit the autoroot.sh from the inject.zip and use the correct files from SuperSU
More information about the files:
https://su.chainfire.eu
Maybe you have to use other files. Not the files from the inject.zip
Download the Update-SuperSU zip from http://download.chainfire.eu/supersu
Copy the files you need to the "su" folder of the extracted inject.zip
For information which files are needed read the "update-binary" file from the SuperSU zip.
(located here META-INF/com/google/android/update-binary)
Good luck everyone :good:

Thanks again for the links! I'll try again soon, when I get time for it, and report the results here
By the way, here's the ls -lR of my system.

Ok, no problem, take your time.
I've got also lot of other work to do...
I just read your system.txt (thanks)
According to these lines:
Code:
lrwxr-xr-x. 1 root 2000 13 Aug 24 02:05 app_process -> app_process32
-rwxr-xr-x. 1 root 2000 13588 Aug 24 02:05 app_process32
It seems that the firmware is 32 bit.
More info about your firmware is in /system/build.prop
So you have to take the right lines from update-binary and copy them and edit the autoroot.sh
Please don't ask me which lines. It's a bit difficult... (you have to understand the logic in update-binary)
Then copy the files from the right folder (arm?) to the "su" folder.
Sorry. I'm out now here for the next time. I have a H815 and happy with it.
I think you will find the solution. :good:

Custom Recoverys
Hi All
Are there any custom recovery's for the G4 beat/G4s
Thanks

Thanks dominik-p for your help. Good luck with your other work, don't worry I won't distract you with asking questions You already helped a lot.
benji5688, you can check for official firmware (.kdz file) on this link, pasting your IMEI instead of YOUR-IMEI in the link below.
http://csmg.lgmobile.com:9002/csmg/b2c/client/auth_model_check2.jsp?esn=YOUR-IMEI
I did not find any for mine there, but I did find it on
http://devtester.ro/projects/lg-firmwares/
Which brought me to this link where I could find mine:
http://pkg02.azure.gdms.lge.com/dn/downloader.dev?fileKey=FW703UV132GQAUP7A0ED99N/H73510c_00.kdz
but you should look for your specific model.

jen.magnolis said:
Hi,
I have been trying to root the LG G4S (H735), also known as "LG G4 Beat".
I tried two things:
Click to expand...
Click to collapse
LOL
I did the exact same thing as you, and really the EXACT, I also contacted dominik-p for the same problem you got with the bs. LOL
Was about to do the same thing you did here too just told that to dominik-p lol.
You post is great, well detailled. Hope someone found something
But got something different. my phone is the LGH731 LG G4 Vigor from Videotron in Canada.
If someone need files or system.img LINK
That's not the exact same thing as the post owner but i'm pretty sure the root method will be. (DON'T use this system.img to inject in you H735) it's from a H731 and they don't have the same partition size.

Ha, that's funny, and you got the same problem of course (frozen logo boot).
We will find a solution. It's just a matter of time. I'm a bit pressed for work in the next days but I'll get back into it around mid week. I think the main problem was, as I suspected and also as dominik-p pointed out, we've been using the wrong inject files. And the G4s is 32 bit so obviously it won't work with 64 bit libs.
First thing I'll try is using the other files from the link dominik-p shared. I'll also read the guide and try to understand which files need to be changed to gain root access in general, i.e. learn the basics of how to root. Then I think/hope I'll be able to fix this. And finally get to move all my stuff onto SD and get my storage back
Meanwhile, if you get any new results, let me know.
Cheers

jen.magnolis said:
Ha, that's funny, and you got the same problem of course (frozen logo boot).
We will find a solution. It's just a matter of time. I'm a bit pressed for work in the next days but I'll get back into it around mid week. I think the main problem was, as I suspected and also as dominik-p pointed out, we've been using the wrong inject files. And the G4s is 32 bit so obviously it won't work with 64 bit libs.
First thing I'll try is using the other files from the link dominik-p shared. I'll also read the guide and try to understand which files need to be changed to gain root access in general, i.e. learn the basics of how to root. Then I think/hope I'll be able to fix this. And finally get to move all my stuff onto SD and get my storage back
Meanwhile, if you get any new results, let me know.
Cheers
Click to expand...
Click to collapse
Yes i'm trying this today (the 32-64 bits thing)

Custom recovery
What does this file do though?
Is it a custom recovery or is it the stock rom?
Thanks Benji

benji5688 said:
What does this file do though?
Is it a custom recovery or is it the stock rom?
Thanks Benji
Click to expand...
Click to collapse
It's the stock ROM. It can be used for recovery, depending what your problem is. If you destroyed your ROM by trying to root, you can recover with this.
If you mess with something in your system partition (where the Android OS is installed), you'd need a copy of your individual system partition (like a "backup") to restore. This highly depends on your phone/version, so you have to do this backup yourself. You can follow the instructions with the dd parameters, linked to from the main thread.

Are there any custom recoverys
Hi
Are there any custom recovery available, I want to get Xposed.
Can anyone make one?
Thanks for all the help

benji5688 said:
Hi
Are there any custom recovery available, I want to get Xposed.
Can anyone make one?
Thanks for all the help
Click to expand...
Click to collapse
I far as I know to get Xposed you need to be rooted... Well there is no root method availaible, well you can try the methods that Jen explained here but I doubt they will work... if yes, you lucky ****

Is the g4s running marshmallow? Is so you would need to use a compatible su install.
Sent from my VS986 using XDA Free mobile app

larsdennert said:
Is the g4s running marshmallow? Is so you would need to use a compatible su install.
Sent from my VS986 using XDA Free mobile app
Click to expand...
Click to collapse
No the problem is really just changing the 64 bits command to make then use the 32 bits ones
I manage everything except this one
Code:
chcon --reference=operatingtable/bin/app_process32 operatingtable/bin/app_process64_original

I agree with xsteacy, this will most likely not work, that's why we opened this discussion
We just have to find the right files to use (instead of the 64 bit ones).
I will get back onto the subject by Wednesday when I have time.

I solved it! My phone is rooted
I asked someone to test my script before I post the results. Hang on there, tomorrow I'll post the solution.
Good times!

jen.magnolis said:
I solved it! My phone is rooted
I asked someone to test my script before I post the results. Hang on there, tomorrow I'll post the solution.
Good times!
Click to expand...
Click to collapse
0.0 OH!?

Ok I'm putting it out there for others to test as well.
Please report if it worked so I can take this into account before updating the main thread instructions.
In the attached .zip file there is a README with instructions.
Note: Thanks goes to @konsolen who shared instructions on how to open the COM port on the H735.
The script in konsolens post is essentially the upater-binary script of the SuperSU package, but with a few modifications.
That may have been necessary on konsolens phone, but it didn't work on mine. For me, using the original script worked.
However, the zip file has to be extracted manually with busybox before the updater-binary script is started. I am not
sure if busybox absolutely needs to be in the /sbin folder, but that's where I saw elsewhere that it belonged, so
I moved it over there in my script. I haven't tested this with busybox being elsewhere.
Thanks goes also to @dominik-p for sharing the link to excellent documentation and for his instructions on how
to make a backup (with dd) of your system, in case anything goes wrong.
UPDATE: I did all commands in root_lgh375.sh manually when I found it already worked, so please report if all is good with the script, but I think it should be, it only does what I did manually.

Congratulations @jen.magnolis
Well done

Working method to root the LG G4S (Model H735 / "LG G4 Beat")

Root your LG G4S (Model H735)
Tested on Andriod 5.1.1.
Thanks goes to @konsolen for sharing the method to open up the port (see appendix in this post) and to @dominik-p for his guide to determine dd parameters (you won't need this to root with the method described, but you can back up your phone if you're worried). And most importantly, thanks to the author of SuperSU for his excellent script updater-binary which worked pretty much out of the box, with only a few workarounds needed (which is what the instructions below do).
First, a few general notes:
The supersu.zip included in this package is version 2.46.
SuperSU can be downloaded here: http://download.chainfire.eu/supersu
If you want to use a new version, just put the zip file in this directory and rename it to "supersu.zip" (delete the old one in this package first of course).
The busybox binary in this package was used successfully to unzip in the LG G4s H735 (Android 5.1.1).
Some time it should maybe be ensured that this is the newest version. Same holds for Send_Command.exe and adb.exe (and attached libraries).
This script uses the "update-binary" script of the SuperSU package to install it on your phone.
The scripts I attached prepare for it to be called (hopefully) successfully.
Instructions to root
Preparation
You MAY want to create a backup of your system beforehand, in case things go wrong.
This is optional, so if you don't want to do this, you may still rely on the .kdz file (see Appendix below) to restore your phone if things go wrong.
You need to calculate the dd parameters and then backup your system partition into a .img file.
There is an excellent guide by @dominik-p for how to determine your individual dd parameters:
http://forum.xda-developers.com/g4/help/how-to-determine-dd-parameters-lg-g4-t3184867
Keep a copy of your system.img somewhere safe, you can use it to restore
your system if something goes wrong.
Enabling developer options and getting the tools
First, enable developer / debugging mode on your phone:
Navigate to Settings > About Phone > scroll to the bottom > tap Build number seven (7) times.
You'll get a short pop-up in the lower area of your display saying that you're now a developer.
Then, go back and now access the Developer options menu, check 'USB debugging' and click OK on the prompt.
Note: You have to enable USB debugging before plugging your device in to the computer. Unplug device then try to enable USB debugging.
On your computer, install Install and Use ADB (the Android Debug Bridge Utility). Also, download LG Flash Tool.
You can find out how to do both by searching google for it.
Step 1.
Connect your phone via USB (not in download mode yet, just normal).
Then, run Init_Root.bat in order to copy the essential files over to internal storage.
You may do this either by 1) double clicking the file, or 2) executing it from the windows command line.
For Option 2): Open a command line in the folder where you extracted this package. To do this, hold shift while right clicking in the folder opened in the Windows Explorer and select "Open command window here". Then, type
Init_Root.bat
Step 2.
Reboot your phone in download mode and ensure it has opened the port to send commands in download mode.
The port is open if it's displayed on the phone's screen in green letters, like
COMX
(with a number instead of X).
On my LG H735 it was necessary to use "LG Flash Tool 2014" http://lgflashtool.com/ to open the port. So if you don't have the green letters, see instruction pasted below (appendix) on how to open the port.
Step 3.
Open a command line in the folder where you extracted this package. To do this, hold shift while
right clicking in the folder opened in the Windows Explorer and select "Open command window here".
Open a command shell to your phone by typing (replace X with the number displayed on your phone) by typing:
Send_Command \\.\COMX
You should be set to root if the following works:
Typing "ls" returns a long list of file and folder names.
Typing "id" should give you someting like that:
uid=0(root) gid=0(root) context=u:r:recovery:s0
The important bits are the "(root)" uid and gid.
If any of the above is not the case, it will not work, you may search for help in the forum.
Step 4.
Execute the commands below (without the numbering of course).
1. mv /data/local/tmp/busybox /sbin/busybox
2. chmod 755 /sbin/busybox
3. mkdir /tmp
4. mkdir /tmp/supersu
5. /sbin/busybox unzip /data/local/tmp/supersu.zip -d /tmp/supersu
6. mv /data/local/tmp/supersu.zip /tmp/supersu/
7. sh /tmp/supersu/META-INF/com/google/android/update-binary dummy 1 /tmp/supersu/supersu.zip
(Note: Not all commands above may be needed, but this is the conservative approach)
Recommended:
Do sanity checks to see if it's doing its job as expected.
After command 2, type the command ls -l /sbin/busybox to check for sanity.
It must return a line like this (with your own date and time):
-rwxr-xr-x shell shell 1048328 <date> <time> busybox
Command 5 must print several lines containing "inflating" messages, similar to this:
Archive:
inflating: META-INF/MANIFEST.MF
...
Command 7 prints lines like this, and other status messages afterwards:
**************
SuperSU installer
**************
...
Step 5.
Your phone should now be rooted if it all worked ok.
You may now type
LEAVE
to reboot your phone.
Happy rooting!
Troubleshooting
If it doesn't work, for example you phone may be stuck on the boot process displaying the LG logo, then you can use Flash Tool to restore your phone. Use instructions below (how to boot the phone into download mode), but don't pull the USB cable, and just let it run its course. This should restore your phone.
If for some reason this hasn't worked, you may try to "dd" back your system .img which you may have created in the preparation step.
Appendix
How to boot the phone into download mode and open the port
a) Boot the LG G4s in download mode. To do this, first switch it off completely and disconnect USB cable. Then, hold the Volume Up button, and while you keep holding it, plug in the USB cable.
b) Start the LG Flash tool and load the .kdz for your phone. We won't actually complete the flashing, you only need it to start the process, but you should use the kdz for your phone nonetheless.
You can check for your kdz on this link, pasting your IMEI instead of YOUR-IMEI in the link below.
http://csmg.lgmobile.com:9002/csmg/b2c/client/auth_model_check2.jsp?esn=YOUR-IMEI
I did not find any for mine there, but I did find it on
http://devtester.ro/projects/lg-firmwares/
Which brought me to this link where I could find mine:
http://pkg02.azure.gdms.lge.com/dn/downloader.dev?fileKey=FW703UV132GQAUP7A0ED99N/H73510c_00.kdz
c) Now this is very important: Watch your phone while the .kdz is being flashed by the flash tool.
(the flash tool may complain about error connecting to the update server, but you can ignore this with "ok").
As soon as the green letters show up, UNPLUG THE USB CABLE!
The percentage on your phone has to be 0% still (never mind about percentage in the flash tool, it may not even display it).
Then, kill the Flash Tool with the Windows Task Manager (Ctrl+alt+delete).
When it's closed, you can plug your phone back in.
It's now in download mode with open port.

You may also be interested in optimizing your storage & memory after you have rooted:
http://forum.xda-developers.com/general/general/moving-apps-to-sd-optimize-memory-phone-t3248125

LG-H731 Vigor from Videotron/Virgin Mobile
jen.magnolis said:
Root your LG G4S (Model H735)
Tested on Andriod 5.1.1.
Click to expand...
Click to collapse
Also work on phone listed in title:
LG-H731 (LG G4) Vigor from Videotron/Virgin Mobile
Happy rooting
If you need help, don't hesitate to contact me: [email protected] or here =

Hi
jen.magnolis said:
Root your LG G4S (Model H735)
Tested on Andriod 5.1.1.
Thanks goes to @konsolen for sharing the method to open up the port (see appendix in this post) and to @dominik-p for his guide to determine dd parameters (you won't need this to root with the method described, but you can back up your phone if you're worried). And most importantly, thanks to the author of SuperSU for his excellent script updater-binary which worked pretty much out of the box, with only a few workarounds needed (which is what the instructions below do).
First, a few general notes:
The supersu.zip included in this package is version 2.46.
SuperSU can be downloaded here: http://download.chainfire.eu/supersu
If you want to use a new version, just put the zip file in this directory and rename it to "supersu.zip" (delete the old one in this package first of course).
The busybox binary in this package was used successfully to unzip in the LG G4s H735 (Android 5.1.1).
Some time it should maybe be ensured that this is the newest version. Same holds for Send_Command.exe and adb.exe (and attached libraries).
This script uses the "update-binary" script of the SuperSU package to install it on your phone.
The scripts I attached prepare for it to be called (hopefully) successfully.
Instructions to root
Preparation
You MAY want to create a backup of your system beforehand, in case things go wrong.
This is optional, so if you don't want to do this, you may still rely on the .kdz file (see Appendix below) to restore your phone if things go wrong.
You need to calculate the dd parameters and then backup your system partition into a .img file.
There is an excellent guide by @dominik-p for how to determine your individual dd parameters:
http://forum.xda-developers.com/g4/help/how-to-determine-dd-parameters-lg-g4-t3184867
Keep a copy of your system.img somewhere safe, you can use it to restore
your system if something goes wrong.
Step 1.
Connect your phone via USB (not in download mode yet, just normal).
Then, run Init_Root.bat in order to copy the essential files over to internal storage.
You may do this either by 1) double clicking the file, or 2) executing it from the windows command line.
For Option 2): Open a command line in the folder where you extracted this package. To do this, hold shift while right clicking in the folder opened in the Windows Explorer and select "Open command window here". Then, type
Init_Root.bat
Step 2.
Reboot your phone in download mode and ensure it has opened the port to send commands in download mode.
The port is open if it's displayed on the phone's screen in green letters, like
COMX
(with a number instead of X).
On my LG H735 it was necessary to use "LG Flash Tool 2014" http://lgflashtool.com/ to open the port. So if you don't have the green letters, see instruction pasted below (appendix) on how to open the port.
Step 3.
Open a command line in the folder where you extracted this package. To do this, hold shift while
right clicking in the folder opened in the Windows Explorer and select "Open command window here".
Open a command shell to your phone by typing (replace X with the number displayed on your phone) by typing:
Send_Command \\.\COMX
You should be set to root if the following works:
Typing "ls" returns a long list of file and folder names.
Typing "id" should give you someting like that:
uid=0(root) gid=0(root) context=u:r:recovery:s0
The important bits are the "(root)" uid and gid.
If any of the above is not the case, it will not work, you may search for help in the forum.
Step 4.
Now you have two options:
#Step 4, Option 1 (recommended to try)
Just run the script and you should be done.
Type:
sh root_lgh735.sh
The script contains all commands I (and other people) used to successfully root the phone.
However we have all used option (2) below, so the script itself has not been tested yet,
though it's very simple (feel free to open it with a text editor to look at it).
You can try to run it, and if it's not doing what's expected you can still go to Option 2
and fix things up.
It will have worked if:
It prints several lines containing "inflating" messages, similar to this:
Archive:
inflating: META-INF/MANIFEST.MF
...
It prints 3 lines like this, and other status messages afterwards:
**************
SuperSU installer
**************
....
If it has done that, reboot your phone and you should be set.
If not, do the commands manually as in Option 2.
Please: If the script worked for you, report it in this thread, so I can simplify these instructions here! Thanks for your help :cyclops:
#Step 4, Option 2:
Execute the commands directly (proven to work on several phones).
Type the commands below (without the numbering of course).
1. mv /data/local/tmp/busybox /sbin/busybox
2. chmod 755 /sbin/busybox
3. mkdir /tmp
4. mkdir /tmp/supersu
5. /sbin/busybox unzip /data/local/tmp/supersu.zip -d /tmp/supersu
6. mv /data/local/tmp/supersu.zip /tmp/supersu/
7. sh /tmp/supersu/META-INF/com/google/android/update-binary dummy 1 /tmp/supersu/supersu.zip
(Note: Not all commands above may be needed, but this is the conservative approach)
Recommended:
Do sanity checks to see if it's doing its job as expected.
After command 2, type the command ls -l /sbin/busybox to check for sanity.
It must return a line like this (with your own date and time):
-rwxr-xr-x shell shell 1048328 <date> <time> busybox
Command 5 must print several lines containing "inflating" messages, similar to this:
Archive:
inflating: META-INF/MANIFEST.MF
...
Command 7 prints lines like this, and other status messages afterwards:
**************
SuperSU installer
**************
...
Step 5.
Your phone should now be rooted if it all worked ok.
You may now type
LEAVE
to reboot your phone.
Happy rooting!
Troubleshooting
If it doesn't work, for example you phone may be stuck on the boot process displaying the LG logo, then you can use Flash Tool to restore your phone. Use instructions below (how to boot the phone into download mode), but don't pull the USB cable, and just let it run its course. This should restore your phone.
If for some reason this hasn't worked, you may try to "dd" back your system .img which you may have created in the preparation step.
Appendix
How to boot the phone into download mode and open the port
a) Boot the LG G4s in download mode. To do this, first switch it off completely and disconnect USB cable. Then, hold the Volume Up button, and while you keep holding it, plug in the USB cable.
b) Start the LG Flash tool and load the .kdz for your phone. We won't actually complete the flashing, you only need it to start the process, but you should use the kdz for your phone nonetheless.
You can check for your kdz on this link, pasting your IMEI instead of YOUR-IMEI in the link below.
http://csmg.lgmobile.com:9002/csmg/b2c/client/auth_model_check2.jsp?esn=YOUR-IMEI
I did not find any for mine there, but I did find it on
http://devtester.ro/projects/lg-firmwares/
Which brought me to this link where I could find mine:
http://pkg02.azure.gdms.lge.com/dn/downloader.dev?fileKey=FW703UV132GQAUP7A0ED99N/H73510c_00.kdz
c) Now this is very important: Watch your phone while the .kdz is being flashed by the flash tool.
(the flash tool may complain about error connecting to the update server, but you can ignore this with "ok").
As soon as the green letters show up, UNPLUG THE USB CABLE!
The percentage on your phone has to be 0% still (never mind about percentage in the flash tool, it may not even display it).
Then, kill the Flash Tool with the Windows Task Manager (Ctrl+alt+delete).
When it's closed, you can plug your phone back in.
It's now in download mode with open port.
Click to expand...
Click to collapse
Have twpr or cwm recovery to install xposed??

I can confirm is working on LG G4 LG-H735P (Latin America version), thanks!

anyone tried updating? just got a system update notification from my phone lol dk if i should update now or not

Good question! I didn't try it yet. Think it should be ok, but if it isn't, you can just root again I guess

jen.magnolis said:
Good question! I didn't try it yet. Think it should be ok, but if it isn't, you can just root again I guess
Click to expand...
Click to collapse
oh.. it wont like brick or anything? :/

dclarkg said:
I can confirm is working on LG G4 LG-H735P (Latin America version), thanks!
Click to expand...
Click to collapse
I could not root my phone, what kdz file did you use??

Backup problems
Hello,
Coming from a Nexus 4, I bought a G4S last month.
I want to do my first root in order to manage the storage, like jen.magnolis talked about.
In case of a problem (bootloop or brick), I need to be able to restore. I don't really mind about restoring my datas, a factory reset would be enough.
But I don't undestand how i can get the system.img without being rooted ? It seems that I can get a "backup.ab" file using adb. Will it be enough to restore in case of brick ?
I also looked about kdz files, but mine doesn't seem to be available. I have a LGH735 (buyer = FRA, suffix = AFRATS, ...). Will it work if I use the one you provided in your post ?
Thanks for your help !

dclarkg said:
I can confirm is working on LG G4 LG-H735P (Latin America version), thanks!
Click to expand...
Click to collapse
I got the same model phone, but I can't find the .KDZ file for it anywhere. Could you post a link to the one you used please?

Excellent step-by-step guide. Should set an example for other "step-by-step guides" which exclude crucial information ("everybody knows lösfhgaeilurhg has to by typed between these steps here, I shall not mention it" )
Thanks a ton Worked on my LG G4S a.k.a H735 like a charm.
Cheers!

dreamnoob said:
anyone tried updating? just got a system update notification from my phone lol dk if i should update now or not
Click to expand...
Click to collapse
jen.magnolis said:
Good question! I didn't try it yet. Think it should be ok, but if it isn't, you can just root again I guess
Click to expand...
Click to collapse
"phone appears to be rooted, will not be updated" - Hiding root did not help, any simple suggestions but total unrooting?
Wanted to upgrade from 10c to 10d...
Cheers!

Doubts.
Hi everyone!
I just cant find my .kdz file! The phone i want to root its a G4 H735AR, im wondering if there are some compatible .kdz that i can use. Im affraid it might get bricked or something...
BTW i¨ve tried the rootworm.bat method and it didnt work. And when i try to open the COMX port, the lg flash tool always crushes and shuts down.

Works!
ascfzz said:
Hi everyone!
I just cant find my .kdz file! The phone i want to root its a G4 H735AR, im wondering if there are some compatible .kdz that i can use. Im affraid it might get bricked or something...
BTW i¨ve tried the rootworm.bat method and it didnt work. And when i try to open the COMX port, the lg flash tool always crushes and shuts down.
Click to expand...
Click to collapse
So, i made it! It works in the H735AR!! The problem with the flash tool was that i was trying to use it without any KDZ file!! I've used @konsolen .kdz and achieved to open ports, and then continue with the rest of the tutorial without trouble.
Thank you so much! Its a great phone, but with so little internal memory is a waste.

chw9999 said:
"phone appears to be rooted, will not be updated" - Hiding root did not help, any simple suggestions but total unrooting?
Wanted to upgrade from 10c to 10d...
Cheers!
Click to expand...
Click to collapse
ya u just update thru lg bridge.. once updated it will be unroot tho so u have to root it back same method as u did before.. and if you use link2sd it dosent matter after root ur link2sd can just reboot and re-read ur partition without needing to wipe and re-partition

It's working in H736P! Thank you só much!
Enviado de meu LG-H736 usando Tapatalk

For people in Brazil that has H736P, to open ports, is necessary the kdz file to use in LG Flash Tool.
Galera do Brasil, consegui rootear o LG G4 Beat usando esse tutorial porém tive que baixar o arquivo kdz pro H736P pra executar o LG Flash Tool. Cuidado ao usar o LG Flash Tool, assim que aparecer a porta COM na tela do telefone, arranca o cabo USB do computador.
Enviado de meu LG-H736 usando Tapatalk

friend you are from argentina?¿

maxiret said:
friend you are from argentina?¿
Click to expand...
Click to collapse
Brasil.
Enviado de meu LG-H736 usando Tapatalk

[! DISCONTINUED !] [TUTORIAL][LOCKED][UNLOCKED][ANY G4] DLM Backup

This thread is superseeded by: https://tinyurl.com/SALTatXDA
NO FURTHER SUPPORT HERE!
DLM Backup is a NANDROID BACKUP IN DOWNLOAD MODE!
(DLM Backup = [D]own[l]oad [M]ode Backup)
The following does not require an unlocked device and so even no TWRP.
Believe it or not but you are able to backup full partitions nevertheless!!! :victory:
.. and all this even for partitions you usually have NO ACCESS TO (e.g. laf, aboot etc) and all this even without root ! wtf its not a dream its true! :victory:
It's really awesome especially for those having a locked device but still wanted to have a nandroid backup
or for those encountering the ILAPO (Infinite Loop Auto Power off or just called "bootloop issue") wanting to save their data!
The following will make full disk dumps of all or only the system essential ones of your device. Choose whichever option you need.
Preparation
First of all you should download FWUL ( https://tinyurl.com/FWULatXDA ).
Every other Linux is fine as well as long as you can handle it! (do not expect support from me then - I support FWUL only)
You may still should consider FWUL as it has everything onboard and is preconfigured to work with Android devices out-of-the-box.
Keep in mind the FWUL password as you need it for the sudo commands within the terminal later.
Once FWUL is running open a terminal (little black icon in the panel):
Code:
git clone [url]https://github.com/steadfasterX/lglaf.git[/url]
cd lglaf
Leave this terminal window open - we need it in the next step.
Then boot your phone into download mode --> the following guide is 100% working and bulletproof:
take out battery and unplug USB cable
plugin USB cable to your PC (while battery ist still out)
wait until you see the missing battery icon (question mark within a battery symbol)
press Volume up and while keeping it pressed put battery in (take care that you do not press the power button)
keep pressing Volume up until you see "Download mode"
If that does not work for you try it this way instead:
unplug USB cable
power down device or pull out battery
put battery back
press Volume up and while keeping it pressed plugin USB cable to your PC (take care that you do not press the power button)
keep pressing Volume up until you see "Download mode"
Your phones screen should look similar to this afterwards:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
You need a USB stick or disk which is big enough to hold the backup.
Depending on the method you need either a ~8 GB one or a 64 GB..
Plugin the USB stick and find out the path to it by just double clicking on the USB stick icon which appears on the desktop after plugging in the stick.
Then write down / copy the path to the stick as shown in the screenshot:
If you encounter problems with the above (e.g. no icon appears after plugging in the USB stick) you can do this in a terminal instead:
Code:
df
Filesystem 1K-blocks Used Available Use%[COLOR="Red"] Mounted on[/COLOR]
dev 16439340 264744 16174596 2% /dev
[............]
/dev/sdd3 2978320 9532 2797780 1%[COLOR="red"] [B]/run/media/android/myusb-stick[/B][/COLOR]
When you are running LL you can skip this step but when you are on MM (or higher...) you need to do the following:
Execute this in your terminal left open from the "Preparation" topic:
Code:
sudo python2 auth.py
you should see something like:
LGLAF.py: DEBUG: Detaching kernel driver for intf 0
LGLAF.py: DEBUG: Using endpoints 83 (IN), 02 (OUT)
auth: DEBUG: Challenge: c0:45:6c:78
auth: DEBUG: Response: b4:1d:1e:cd:e8:f1:5f:b5:fa:78:9e:f8:2d:c6:83:86
Click to expand...
Click to collapse
Now you are authenticated with the download mode and we can continue:
Option A) FULL backup (includes everything e.g. system, cache and userdata / internal storage)
When to use:
if you want to flash new ROMs or bootloader stacks
if you want to backup all your internal storage (e.g. pictures, videos and stuff) - keep in mind TWRP does NOT backup your internal storage!!
if you want to have a real FULL NANDROID (e.g. TWRP will not backup partitions like misc, persistent, persistent-lg etc)
Requirements:
- FWUL
- a 64 GB or bigger USB stick / disk
Execute this in your terminal left open from the "Preparation" topic:
Code:
sudo python2 extract-partitions.py --max-size 0 -d [I]YOURUSBSTICKpath[/I]
(replace YOURUSBSTICKpath with the path you discovered in the Preparation topic!)
Be patient.. this can take a loooong time!
You can watch the progress e.g with executing this in a NEW terminal (just click the terminal icon in the panel again):
Code:
watch 'ls -lathr [I]YOURUSBSTICKpath[/I] | tail '
(replace YOURUSBSTICKpath with the path you discovered in the Preparation topic!)
Once finished you can reboot by either taking out the battery or typing:
Code:
sudo python2 lglaf.py --skip-hello -c '!CTRL RSET'
Option B) system essentials backup (does *NOT* include system, cache and userdata / internal storage!!)
When to use:
if you want to flash new bootloader stacks
if you want to backup your current lock/unlock state
if you want to backup your IMEI and EFS
Requirements:
FWUL
a 4 - 8 GB or bigger USB stick / disk
Execute this in your terminal left open from the "Preparation" topic:
Code:
sudo python2 extract-partitions.py -d [I]YOURUSBSTICKpath[/I]
(replace YOURUSBSTICKpath with the path you discovered in the Preparation topic!)
Be patient.. this can take some time!
You can watch the progress e.g with executing this in a NEW terminal (just click the terminal icon in the panel again):
Code:
watch 'ls -lathr [I]YOURUSBSTICKpath[/I] | tail '
(replace YOURUSBSTICKpath with the path you discovered in the Preparation topic!)
Once finished you can reboot by either taking out the battery or typing:
Code:
sudo python2 lglaf.py --skip-hello -c '!CTRL RSET'
... and the last 2 things which need to be done
1) Click the thanks button here
2) Enjoy
Restore a DLM Backup
Checkout Post #2 for the restore howto
Credits
Peter Wu for his absolutely awesome job on reverse engineering the LAF protocol and offering the lglaf code as python code.
Main thread for lglaf: https://forum.xda-developers.com/android/software-hacking/tool-lg-download-mode-laf-t3285946/page1
Donations: https://forum.xda-developers.com/member.php?u=4790426
.

Restore a previously taken backup or partitions of an already extracted KDZ
There are 2 methods available - choose the one matching your needs:
A) Restore a previously taken DLM Backup
B) Flash a KDZ / LGUP NG by sfX
Unfortunately this may not work on every firmware so you may try different firmwares then and you will receive the same error regarding communication port closing but in general it should work this way.
A) Restore a previously taken DLM Backup / Restore partitions from an extracted KDZ
To restore single partitions use the following
sudo python2 auth.py
sudo python2 partitions.py --restore /path/to/dumpfile partitionname
e.g.
sudo python2 auth.py
sudo python2 partitions.py --restore /tmp/misc misc (would restore the misc partition)
To restore ALL partitions in a folder
For this the best is to use the new LGUP NG kdzmanager which is explained in the next topic.
Install LGUP NG but skip the steps to extract a KDZ if you don't need it.
Then:
bash kdzmanager.sh --test --flash /path/to/imagefiles
(/path/to/imagefiles must contain your previously taken DLM backup files or an extracted KDZ)
This will just test flashing and not actually flash.
If that looks fine do it again but without --test parameter:
bash kdzmanager.sh --flash /path/to/imagefiles
B) Flash a KDZ / LGUP NG (next generation) by sfX
Forget LGUP to flash a KDZ from now on!
Just use my KDZManager
Features:
No worries anymore about those crappy DLL issues
Extract a KDZ
Test flashing partitions (dry run without actually flashing anything)
Flash partitions from a KDZ
when flashing avoid erasing/wiping userdata (keep your data between KDZ flashes)
Hint: not wiping userdata can occur in a bootloop when its not compatible with the ROM! So use that option with care.
will work on any Linux (but FWUL is the only supported)
Keep in mind that this is an early release and there are NO CHECKS like ARB or even if the device model matches with the KDZ but THIS WILL ALL COME (even with an option to override and flash regardless)
Roadmap:
GUI
Check for matching device model
Check for ARB
Instructions:
Boot FWUL (or your Linux but keep in mind that only FWUL is supported), choose language & login
Download the KDZ file you want to flash (we need to know the path later e.g. /home/android/Downloads/)
Open the folder LG
Connect device in download mode to the PC
Double click "LG laf NG" icon
Type in the new opened terminal:
sudo python2 auth.py
[*]sudo python2 partitions.py --list
If this lists your partitions then we can proceed with flashing.
Download my brand new kdzmanager tool in FWUL: (right click and save as)
When you are not using the persistent mode of FWUL: plug in a big USB stick (e.g. 32 GB or more) into FWUL and extract the attached file there
When you are using the persistent mode of FWUL: just extract it in your download folder
You need to know the full path so best is copying the path from the file manager (e.g. /home/android/Downloads/ ) or leave the file manager open there
Open another terminal (black little icon in the panel)
cd and directly behind this paste the path you copied (e.g. cd /home/android/Downloads/ )
press ENTER
bash kdzmanager.sh -x FILLINFULLPATH-TO-DOWNLOADED-KDZ
(e.g. bash kdzmanager.sh -x /home/android/Downloads/h811blablubb.kdz)
WARNING-1: Keep in mind that atm kdzmanager is not able to proof if you choose a compatible KDZ file for your device!
Check your device model and the KDZ twice!
WARNING-2: Keep in mind that atm kdzmanager is not able to proof your current ARB version so flashing an smaller ARB then your current one will BRICK your device.
Check ARB first: CLICK
If you understood the above 2 warnings proceed like this:
bash kdzmanager.sh --test --flash extracteddz/
(just like this as "extracteddz" is the path generated by the kdzmanager)
This will just test flashing and not actually flash. Let me know the results of this (copy & paste output)
if you can't wait the next step would be actually flashing ofc:
WARNING: by default the kdzmanager will not overwrite userdata (which would be like a factory reset) and I would recommend to leave it out always and better choose the LG factory reset menu (after flashing completed) if required. If you still want to flash it use --with-userdata as a parameter (can take a loooong time then btw).
bash kdzmanager.sh --flash extracteddz/
last step ( will be included in the next release): wipe your userdata:
sudo partitions.py --wipe userdata
Or just use the factory reset hardware key combo to do the same.
If you skip this step you may encounter a bootloop. If that happens you can at any time use the hardware key combo to boot into factory reset to fix that.
sfX

FAQ
1. Q: You get the error message: "Expected arrow in ls output" when executing lglaf
A: update to the latest version of lglaf (thx to @tulen_kobi for this patch!). For updating lglaf on FWUL check Q4.
If the error still persists your download mode version is not supported by lglaf. Its very likely that your carrier has a very strict policy activated in download mode. The only chance is to try other download mode version meaning to flash different KDZ files (on locked devices) or just the laf.img in fastboot (on unlocked devices).
On Nougat and when unlocked it is enough to just flash the laf.img of MM and you can use lglaf again.
2. Q: You get not an error but messages or files containing just "Hello, I am LAF. Nice to meet you."
A: your download mode version is not supported by lglaf. Its very likely that your carrier has a very strict policy activated in download mode. The only chance is to try other download mode version meaning to flash different KDZ files (on locked devices) or just the laf.img in fastboot (on unlocked devices).
On Nougat and when unlocked it is enough to just flash the laf.img of MM and you can use lglaf again.
3. Q: All seems fine but at the end of a command you see: "comm.call(close_cmd) [....someotherstuff...] Command failed with error code 0x8000010a"
A: This is known and not a serious issue. Once I have the time I will fix it but in the meanwhile pls ignore..
This has been fixed. please update your LGlaf like described in the next FAQ
4. Q: I want to update lglaf on FWUL v2 or higher
ok here is the correct way to achieve this on FWUL v2:
cd ~programs/lglafng/
git pull
git checkout g4
then you're up2date and can try again while in this folder!
sfX

I'm so happy that you were able to finally get this working. It's dumping my system partition right now. I'll report back when it's done.
Also. You should note that the sudo password is "linux" and to view progress on the dump, you should specify that the command should be opened in a new terminal window.
Over all. Awesome tutorial!
EDIT: Was able to retrieve 7gb of lost pictures thanks to this method! Thank you!

How to restore? Is it possible?

mateus.sc said:
How to restore? Is it possible?
Click to expand...
Click to collapse
Yes even that.. I will write down a restore guide soon.
.
Sent from my LG-H815 using XDA Labs

I cannot Auth with my device.
I get the first 2 lines from the auth.py command
No challenge or response.
Using Virtualbox.

OllieD said:
I cannot Auth with my device.
I get the first 2 lines from the auth.py command
No challenge or response.
Using Virtualbox.
Click to expand...
Click to collapse
what Android version is installed currently?
.

steadfasterX said:
what Android version is installed currently?
.
Click to expand...
Click to collapse
20G Stock Locked Bootloader.
Rebooted into live environment and worked.
Extract partitions errored out
Traceback (most recent call last):
File "extract-partitions.py", line 63, in <module>
main()
File "extract-partitions.py", line 60, in main
dump_partitions(comm, disk_fd, args.outdir, args.max_size * 1024)
File "/usr/lib/python2.7/contextlib.py", line 24, in __exit__
self.gen.next()
File "/home/android/lglaf/partitions.py", line 78, in laf_open_disk
comm.call(close_cmd)
File "/home/android/lglaf/lglaf.py", line 176, in call
raise RuntimeError('Command failed with error code %#x' % errCode)
RuntimeError: Command failed with error code 0x8000010a
After Dumping, Option B
Also the Firefox installer although it installs Firefox it wont launch and gives a SQLite Version Error so it will not run.
Chromium works fine.
Now i've backed up i can try and install V29

OllieD said:
20G Stock Locked Bootloader.
Rebooted into live environment and worked.
Extract partitions errored out
Traceback (most recent call last):
File "extract-partitions.py", line 63, in <module>
main()
File "extract-partitions.py", line 60, in main
dump_partitions(comm, disk_fd, args.outdir, args.max_size * 1024)
File "/usr/lib/python2.7/contextlib.py", line 24, in __exit__
self.gen.next()
File "/home/android/lglaf/partitions.py", line 78, in laf_open_disk
comm.call(close_cmd)
File "/home/android/lglaf/lglaf.py", line 176, in call
raise RuntimeError('Command failed with error code %#x' % errCode)
RuntimeError: Command failed with error code 0x8000010a
After Dumping, Option B
Also the Firefox installer although it installs Firefox it wont launch and gives a SQLite Version Error so it will not run.
Chromium works fine.
Now i've backed up i can try and install V29
Click to expand...
Click to collapse
well it sounds like u have not much RAM attached to your VM then. 4 GB are recommended.
The dump error can be ignored as long as auth.py has worked before and everything gets dumped..
.

steadfasterX said:
Just a quick note:
I completely re-worked the guide and fixed an issue for devices running MM!
Just re-do the guide if you encountered an issue before.
.
Click to expand...
Click to collapse
what if .. i dont have USB.? am planning of backing up my IMEI. as i been reading this on the new N roms..
what can i do.?

raptorddd said:
what if .. i dont have USB.? am planning of backing up my IMEI. as i been reading this on the new N roms..
what can i do.?
Click to expand...
Click to collapse
If you have an unlocked device you have luck and you could use dd commands in TWRP. I know that yours is unlocked so you could use dd on every partition available on your device.
Tbh the most important seems to be persistent, fsg, misc but until I know for sure I would just backup EVERY partition. It's only needed once in the phones life usually so it doesn't hurt..
I need to have my device repaired before I can test it further so this can take a while.. Until then the backup of every partition is the best choice.
if the device is locked and on LL then TWRP in FIsH plus the mentioned dd commands can be used as well. I would still recommend the download mode backup though..
if the device is locked and on MM or N (haven't tested N in download mode though) then USB plus download mode is the only choice.
.
Sent from my LG-H815 using XDA Labs

Similar question. What's the quick and dirty way to backup these partitions from terminal app / busybox?
Dd if=??? Etc
not sure if different between models but mines h815 international running 'stock' nougat

steadfasterX said:
If you have an unlocked device you have luck and you could use dd commands in TWRP. I know that yours is unlocked so you could use dd on every partition available on your device.
Tbh the most important seems to be persistent, fsg, misc but until I know for sure I would just backup EVERY partition. It's only needed once in the phones life usually so it doesn't hurt..
I need to have my device repaired before I can test it further so this can take a while.. Until then the backup of every partition is the best choice.
if the device is locked and on LL then TWRP in FIsH plus the mentioned dd commands can be used as well. I would still recommend the download mode backup though..
if the device is locked and on MM or N (haven't tested N in download mode though) then USB plus download mode is the only choice.
.
Sent from my LG-H815 using XDA Labs
Click to expand...
Click to collapse
OMG so basically if this works in locked N, can I flash the korean v30 kdz and then restore a backup the modem.img from v29a made for my H815 with this method?
The possibilities are amazing

obvious said:
Similar question. What's the quick and dirty way to backup these partitions from terminal app / busybox?
Dd if=??? Etc
not sure if different between models but mines h815 international running 'stock' nougat
Click to expand...
Click to collapse
I will add it in the TWRP thread ASAP
mateus.sc said:
OMG so basically if this works in locked N, can I flash the korean v30 kdz and then restore a backup the modem.img from v29a made for my H815 with this method?
The possibilities are amazing
Click to expand...
Click to collapse
Technically this method can provide that (as said I can't test N atm though so I don't know if this works in general for N but if LG hasn't changed anything.. )
but:
keep in mind that cross flashing partitions can result in a soft brick on locked devices!! I don't know how N behaves here tbh so it may just work or it may soft brick in the specific case of modem.
So it would be nice to have someone trying to use the auth command on a N bootloader stack. This will not harm anything but then we know for sure if this is usable for N or not
.
Sent from my LG-H815 using XDA Labs

steadfasterX said:
If you have an unlocked device you have luck and you could use dd commands in TWRP. I know that yours is unlocked so you could use dd on every partition available on your device.
Tbh the most important seems to be persistent, fsg, misc but until I know for sure I would just backup EVERY partition. It's only needed once in the phones life usually so it doesn't hurt..
I need to have my device repaired before I can test it further so this can take a while.. Until then the backup of every partition is the best choice.
if the device is locked and on LL then TWRP in FIsH plus the mentioned dd commands can be used as well. I would still recommend the download mode backup though..
if the device is locked and on MM or N (haven't tested N in download mode though) then USB plus download mode is the only choice.
.
Sent from my LG-H815 using XDA Labs
Click to expand...
Click to collapse
yes unlocked.. i downloaded FWUL but on step to place the command for python i had directiry not found and gave up use twrp for EFS.
for DD what are commands is this using ternimal? where can i find all the command to extract say boot ,system modem ect.?

raptorddd said:
yes unlocked.. i downloaded FWUL but on step to place the command for python i had directiry not found and gave up use twrp for EFS.
for DD what are commands is this using ternimal? where can i find all the command to extract say boot ,system modem ect.?
Click to expand...
Click to collapse
just try my new twrp version which will be uploaded in 5 minutes..
.

Hey I'm getting an error in running this - phone is in download mode and connected. Using FWUL on my machine and trying to dump to an extrernal HD (path below in first line).
Code:
[[email protected] lglaf]$ sudo python2 extract-partitions.py --max-size 0 -d /run/media/android/16a064ee-96de-4c4d-8c30-29cbcc2e5441/
Traceback (most recent call last):
File "extract-partitions.py", line 63, in <module>
main()
File "extract-partitions.py", line 60, in main
dump_partitions(comm, disk_fd, args.outdir, args.max_size * 1024)
File "extract-partitions.py", line 24, in dump_partitions
parts = partitions.get_partitions(comm)
File "/home/android/lglaf/partitions.py", line 41, in get_partitions
assert arrow == '->', "Expected arrow in ls output"
AssertionError: Expected arrow in ls output

ReeS86 said:
Hey I'm getting an error in running this - phone is in download mode and connected. Using FWUL on my machine and trying to dump to an extrernal HD (path below in first line).
Click to expand...
Click to collapse
Yea... I saw that on another phone as well. Weird.
I need your help to fix it..
Could you come into IRC on Monday?
sfX
Sent from my LG-H815 using XDA Labs

steadfasterX said:
Yea... I saw that on another phone as well. Weird.
I need your help to fix it..
Could you come into IRC on Monday?
sfX
Sent from my LG-H815 using XDA Labs
Click to expand...
Click to collapse
Ya I'll try to pop on after work. Can also see if the secure boot thing works once I get that backup.

[Q&A] ASUS Fonepad 7 K00E ME372CG - looking for correct files for xFSTK

Please, where can I find ME372CG files for xFSTK?
I want to restore bootloader of my ME372CG tablet.
I follow these instructions, which are for FE170CG:
https://forum.xda-developers.com/android/help/asus-fonpad-7-fe170cg-bricked-stuck-t3740819
But I did not find ME372CG files for xFSTK.
So I took them from official Asus ME372CG firmware (from UL-K00E-WW-7.6.0.0-user.zip).
I found different file names in ifwi folder and I am not sure, which to use fo xFSTK:
dnx_fwr_ctp_???.bin
ifwi_ctp_???.bin
CLVP_CSAB_FWR_DnX_20.29.bin
ME372CG_32_IFWI_v54.57_CSAB_PROD.bin
I could not find any Softfuse file either.
Most probably I do not have the correct files, because xFSTK download does not work.
The file names, which I used, and the result from xFSTK can be found here:
https://www.dropbox.com/s/cz8imzdrs1r551r/xFSTK_ME372CG files.JPG?dl=0
Where can I find the correct files for xFSTK?
Thank you very much.
Greetings from Slovakia
Juraj
---
Cause of malfunction:
My tablet reported some kind of UI error, so I restarted it (still within Android),
but it never started again. It just vibrates when switching on, always black screen (only almost unnoticeable flash of light on LCD, during switching on). The battery is full - I measured it.

Use this file, run as Administrator ME372CG Debrick.bat and connect your device.
https://gofile.io/d/P6Ja57
After that flash this raw file with asus flash tool and make sure to select right model name.
http://www.mediafire.com/file/fhtkb..._V11.2.3.33-raw_2015_SmartPhones.How.zip/file
Good Luck

Teddy Lo said:
Use this file, run as Administrator ME372CG Debrick.bat and connect your device.
https://gofile.io/d/P6Ja57
After that flash this raw file with asus flash tool and make sure to select right model name.
http://www.mediafire.com/file/fhtkb..._V11.2.3.33-raw_2015_SmartPhones.How.zip/file
Good Luck
Click to expand...
Click to collapse
Hey Teddy, The link has been expired! Can you upload it again?
I need FW DnX, IFWI, OS DnX for fonepad 7 ME372CG (K00e)

sid.1375 said:
Hey Teddy, The link has been expired! Can you upload it again?
I need FW DnX, IFWI, OS DnX for fonepad 7 ME372CG (K00e)
Click to expand...
Click to collapse
Hi, I received some suggestions from Teddy, but it did not work for me.
(I re-uploaded the files to Dropbox, so the links should work):
1. Download this zip: https://www.dropbox.com/s/1s5i85hd22yqlct/CSC_ME372CG_Debrick.7z?dl=0
2. Extract with 7-zip on your Desktop
3. Open extracted CSC_ME372CG_Debrick file ---> Right click on ME372CG Debrick.bat left click on Run as Administrator. And it should look like this:
https://www.dropbox.com/s/e3yulpxt70rn6ly/non-Administrator ME372CG Debrick.bat.png?dl=0
If that doesn't show up install this minimal adb and fastboot command
https://www.dropbox.com/s/zgr1ljdm13owlrs/minimal_adb_fastboot_v1.4.1_setup.exe?dl=0
Here is tutorial how to install:
https://forum.xda-developers.com/showthread.php?t=2317790
4. If the tool doesn't recognise your device press VOL + or VOl - and connect your device with pc while you are holding one of volume buttons.....
===
After I informed Teddy that it does not work for me,
he suggested this:
See this tutorial for another device to get the point, reinstall drivers and try again debrick files. Softfuse file I can't find for your device but with debrick.bat is trick for seconds I thing to get recognized to start flashing partition and firmware....
https://www.youtube.com/watch?v=xuD39TjQJGo
or buy package and download files for XFSTK.
https://easy-firmware.com/index.php?a=downloads&b=file&id=100391
(I have not bought those xFSTK files yet, but I will try it later this week and let you know.)
Juraj

jurajhotovy said:
Hi, I received some suggestions from Teddy, but it did not work for me.
(I re-uploaded the files to Dropbox, so the links should work):
1. Download this zip: https://www.dropbox.com/s/1s5i85hd22yqlct/CSC_ME372CG_Debrick.7z?dl=0
2. Extract with 7-zip on your Desktop
3. Open extracted CSC_ME372CG_Debrick file ---> Right click on ME372CG Debrick.bat left click on Run as Administrator. And it should look like this:
https://www.dropbox.com/s/e3yulpxt70rn6ly/non-Administrator ME372CG Debrick.bat.png?dl=0
If that doesn't show up install this minimal adb and fastboot command
https://www.dropbox.com/s/zgr1ljdm13owlrs/minimal_adb_fastboot_v1.4.1_setup.exe?dl=0
Here is tutorial how to install:
https://forum.xda-developers.com/showthread.php?t=2317790
4. If the tool doesn't recognise your device press VOL + or VOl - and connect your device with pc while you are holding one of volume buttons.....
===
After I informed Teddy that it does not work for me,
he suggested this:
See this tutorial for another device to get the point, reinstall drivers and try again debrick files. Softfuse file I can't find for your device but with debrick.bat is trick for seconds I thing to get recognized to start flashing partition and firmware....
https://www.youtube.com/watch?v=xuD39TjQJGo
or buy package and download files for XFSTK.
https://easy-firmware.com/index.php?a=downloads&b=file&id=100391
(I have not bought those xFSTK files yet, but I will try it later this week and let you know.)
Juraj
Click to expand...
Click to collapse
I tried that but it didn't work. Actually it's because we lost fastboot and droidboot.
About those xFSTK files, we can acquire them from rom (zip/raw). there is a zip file called "ifwi.zip" in the rom package.
I follow this tutorial to debrick it but I didn't make it:crying:

sid.1375 said:
I tried that but it didn't work. Actually it's because we lost fastboot and droidboot.
About those xFSTK files, we can acquire them from rom (zip/raw). there is a zip file called "ifwi.zip" in the rom package.
I follow this tutorial to debrick it but I didn't make it:crying:
Click to expand...
Click to collapse
Hi
Finally, did you can find a solution for K00E?

miter8 said:
Hi
Finally, did you can find a solution for K00E?
Click to expand...
Click to collapse
Unfortunately no.
Sorry for the late response.

Question We need unbrick tool for Redmagic 6/6 pro

Hello everyone, I want to ask if there is any developer who can help us please, we need unbrick tool for Redmagic 6 and 6 pro ASAP because the RM support team doesn't answer our complaints or emails. Please help us

M5tha said:
Hello everyone, I want to ask if there is any developer who can help us please, we need unbrick tool for Redmagic 6 and 6 pro ASAP because the RM support team doesn't answer our complaints or emails. Please help us
Click to expand...
Click to collapse
i've been waiting for my paperweight turn into a phone for a month now, i don't think it will be here any soon....

Nocturne Seigneur said:
i've been waiting for my paperweight turn into a phone for a month now, i don't think it will be here any soon....
Click to expand...
Click to collapse
It’s like Cinderella turning into a pumpkin after midnight. Our devices went from being phones to paperweights overnight.
Someone get our fairy god mothers up in here to bipity bopity this crap back into a working state

Out of curiosity may I ask how did it get to this state? Also I was able to get myself out thru a combination of reflashing boot.img (i was on 4.12), unlocking and relocking bootloader, and factory resetting via recovery mode. Not in that order and each multiple times. Somehow it worked out. Possibly worth a try if you are just waiting anyways with not too much to lose?
I found that a locked bootloader is good at telling whether you didn't quite flash an img right. It kept telling me that things are corrupt and whatnot, and all of a sudden it booted.

So I'm pretty close to getting a working TWRP for this device. I have extracted a basic TWRP.img file and merged it with the boot image for the Red Magic 6. When I flashed it, the logo shows up but nothing happens.
When I have time this weekend, I'll mess around with it some more.
That way we can unbrick it with twrp and not have to worry about waiting for an unbrick tool.

Nocturne Seigneur said:
i've been waiting for my paperweight turn into a phone for a month now, i don't think it will be here any soon....
Click to expand...
Click to collapse
I didn't unlock my bootloader, so I can't do anything to unbric this **** device

M5tha said:
I didn't unlock my bootloader, so I can't do anything to unbric this **** device
Click to expand...
Click to collapse
I’m in the same boat but Nubia is having me send my phone back to them to check out.

Guys the unbrick tool is already in this forum: https://forum.xda-developers.com/t/unbrick-tool-edl-flash-switch-from-cn-to-eu.4284797/
Note if you are rooted before going to EDL mode (9008) you should backup EFS via QFIL QCOM tool as a few people lost their IMEIs - I think it's in EFS Explorer the tool is free just Google it. Then do an EFS backup and save where you can't lose it. Here's a guide just ignore the Lenovo part, but you must go into diag mode Qualcomm 901D which is (try dial code *#7678# first it worked on the Red Magic 5 series, probably puts you in diag mode still) otherwise: adb shell; su; setprop sys.usb.config diag,adb before QFIL will see it: https://forums.easy-firmware.com/showthread.php/29143-How-To-Restore-Backup-QCN-EFS-on-Qualcomm-devices-(Giuide)
You can also back up the partition if you are rooted via adb shell. From memory, enable dev options (click build # under system until it shows up), patch your boot.img with Magisk Manager (should be in the ROM zip file you downloaded, copy to phone), flash back to the phone with fastboot (it will be in Downloads/magisk_patched_xyz.img "xyz" changes names just depends on Magisk) command is just after reboot to fastboot: fastboot flash boot magisk_patched_xyz.img; reboot and you should be rooted. Then from ADB do an ADB shell (it will ask to trust the device connected) adb shell (on PC), su (will ask for root access, grant it), $ dd if=/dev/block/bootdevice/by-name/persist of=/sdcard/persist.img and copy that to your PC. That's your persist partition in case it gets messed up you should be able to: $dd if=/sdcard/persist.img of=/dev/block/bootdevice/by-name/persist that assumes you copied persist.img back to your /sdcard/ in internal memory.
If I messed up a step feel free to correct it, this is all from memory no PC in front of me on vacation...

mslezak said:
Guys the unbrick tool is already in this forum: https://forum.xda-developers.com/t/unbrick-tool-edl-flash-switch-from-cn-to-eu.4284797/
Note if you are rooted before going to EDL mode (9008) you should backup EFS via QFIL QCOM tool as a few people lost their IMEIs - I think it's in EFS Explorer the tool is free just Google it. Then do an EFS backup and save where you can't lose it. Here's a guide just ignore the Lenovo part, but you must go into diag mode Qualcomm 901D which is (try dial code *#7678# first it worked on the Red Magic 5 series, probably puts you in diag mode still) otherwise: adb shell; su; setprop sys.usb.config diag,adb before QFIL will see it: https://forums.easy-firmware.com/showthread.php/29143-How-To-Restore-Backup-QCN-EFS-on-Qualcomm-devices-(Giuide)
You can also back up the partition if you are rooted via adb shell. From memory, enable dev options (click build # under system until it shows up), patch your boot.img with Magisk Manager (should be in the ROM zip file you downloaded, copy to phone), flash back to the phone with fastboot (it will be in Downloads/magisk_patched_xyz.img "xyz" changes names just depends on Magisk) command is just after reboot to fastboot: fastboot flash boot magisk_patched_xyz.img; reboot and you should be rooted. Then from ADB do an ADB shell (it will ask to trust the device connected) adb shell (on PC), su (will ask for root access, grant it), $ dd if=/dev/block/bootdevice/by-name/persist of=/sdcard/persist.img and copy that to your PC. That's your persist partition in case it gets messed up you should be able to: $dd if=/sdcard/persist.img of=/dev/block/bootdevice/by-name/persist that assumes you copied persist.img back to your /sdcard/ in internal memory.
If I messed up a step feel free to correct it, this is all from memory no PC in front of me on vacation...
Click to expand...
Click to collapse
I locked the bootlooder the screen is black, the only way to connect to the device is on a PC "COM",
I tried this link but and the next steps but it doesn't work, I don't know what to do with the phone and still it doesn't work,
I think I need the firmware RED MAGIC 6 "NX669J_NON EU Common".
PLEASE HELP ME
https://mega.nz/file/ntBSxDKa#h9vUPGoWVyqtyDYWYmSgz8bE1_vNimBMAqTp9csvv-w
2) Make sure all the drivers are installed correctly (Qualcomm, EDL etc...)
3) Open the MiTool application
4) in MiTool, select the folder images
5) Put your phone in EDL mode
6) Once connected, Click flash - the brushing process will start automatically.

Good evening I found a guy who unlocked the phone for me at 150 dollars.
the phone quickly repaired without any problems so the problem is solved.

Marofyxx said:
I locked the bootlooder the screen is black, the only way to connect to the device is on a PC "COM",
I tried this link but and the next steps but it doesn't work, I don't know what to do with the phone and still it doesn't work,
I think I need the firmware RED MAGIC 6 "NX669J_NON EU Common".
PLEASE HELP ME
https://mega.nz/file/ntBSxDKa#h9vUPGoWVyqtyDYWYmSgz8bE1_vNimBMAqTp9csvv-w
2) Make sure all the drivers are installed correctly (Qualcomm, EDL etc...)
3) Open the MiTool application
4) in MiTool, select the folder images
5) Put your phone in EDL mode
6) Once connected, Click flash - the brushing process will start automatically.
Click to expand...
Click to collapse
i tried running it and now the phone is on but no display . who can help me ?
my device is :
Model: NX669J-P
Red magic OS :V4.5
Build number : NX669J_CNCommon_V7.14
Adroid version :11
Hardware version : NX669J_V1AM
I will pay for the software for you if I have to . Hope your help!

Hello,
I can give you the email of the person who repaired my phone but it's expensive 150dollar

manhdoan1601 said:
i tried running it and now the phone is on but no display . who can help me ?
my device is :
Model: NX669J-P
Red magic OS :V4.5
Build number : NX669J_CNCommon_V7.14
Adroid version :11
Hardware version : NX669J_V1AM
I will pay for the software for you if I have to . Hope your help!
Click to expand...
Click to collapse
Hello,
I can give you the email of the person who repaired my phone but it's expensive 150dollar

guide

Marofyxx said:
Hello,
I can give you the email of the person who repaired my phone but it's expensive 150dollar
Click to expand...
Click to collapse
i can pay it 150 usd . give me email

Ok

hey guys..
can u pls share qcn or especially xqcn for NX669J..?