Develop Bugs

Rooting LG H735 G4 Beat

hi, tried to search everywhere but to no avail soo far.. does anyone knows if there is an existing root guide for LG G4 Beat? its sort of a diff model but there's no sub for it so i guess ill put it at here since its still under G4 family.. :/

Do you have Android 5.0 or 5.1 installed?
First of all. Before you start to try root, download the kdz file for your phone.
The kdz is needed if something went wrong (e.g. phone not booting).
You can use the LG Flash Tool to flash the kdz to a bricked phone.
Use this link with your IMEI:
Code:
http://csmg.lgmobile.com:9002/csmg/b2c/client/auth_model_check2.jsp?esn=IMEI
If it works, please post the download link for the "kdz".
Or better post the output too, but delete your IMEI!
Your link will only work if you type:
csmgdl.lgmobile.com/dn/downloader.dev?fileKey=
and then add the rest of your url instead of the given link.

It's worth trying. You need to get a partition layout. Then @autoprime will give a full command to run in DL mode for dumping the system image, and flashing it once it's been injected with root. I can inject it for you once you have the system.img dump.

I wrote an guide how you can extract the GPT and calculate the dd parameters:
[How to] Determine dd Parameters For All LG G4 Models
http://forum.xda-developers.com/g4/h...lg-g4-t3184867
Do you know how to work with linux?
Please post the outputs of gdisk into a HIDE and CODE tag. Thank you.
Maybe you are a advanced user and can Inject root yourself with the autoroot.sh method (Inject_Root_G4.zip)?
Or do you need help?
I think you have Android 5.1.1 installed, so it is not possible to use Kingroot to root your device. Is that right?

dominik-p said:
I wrote an guide how you can extract the GPT and calculate the dd parameters:
[How to] Determine dd Parameters For All LG G4 Models
http://forum.xda-developers.com/g4/h...lg-g4-t3184867
Do you know how to work with linux?
Click to expand...
Click to collapse
Wow, thanks for that guide! I've been trying to figure out how to find the right dd params forever.

tabp0le said:
Wow, thanks for that guide! I've been trying to figure out how to find the right dd params forever.
Click to expand...
Click to collapse
Pleasure.
I think some people also knew how to do it, but no one wanted to write a guide.
AND ALWAYS CONSIDER:
You can brick your phone if you don't know what you are doing.
Backup your files before you change anything.

i think i got the link for the KDZ.. but when i
dominik-p said:
Do you have Android 5.0 or 5.1 installed?
First of all. Before you start to try root, download the kdz file for your phone.
The kdz is needed if something went wrong (e.g. phone not booting).
You can use the LG Flash Tool to flash the kdz to a bricked phone.
Use this link with your IMEI:
[CODEcsmg.lgmobile.com:9002/csmg/b2c/client/auth_model_check2.jsp?esn=IMEI[/CODE]
If it works, please post the download link for the "kdz".
Or better post the output too, but delete your IMEI!
Your link will only work if you type:
csmgdl.lgmobile.com/dn/downloader.dev?fileKey=
and then add the rest of your url instead of the given link.
Click to expand...
Click to collapse
ok i think i did it correctly.. heres the link
downloader.dev?fileKey=FWDEYI0132FMAUI263CCLO1/H73510b_00.kdz (had to cut it short cuz forum would not let me post new link :/ csmgdl.lgmobile.com/dn/ was before 'downloader')
heres the output file..
<response req_cmd="auth_model_check" status="OK">
<auth_model_check><result>OK</result>
<esn>-----MYIMEI----</esn>
<model>LGH735</model><suffix>ASEATS</suffix><msn>508KPUU032390</msn><esn_date/>
<sw_version>H73510B_00</sw_version>
<sw_url>fileKey=FWDEYI0132FMAUI263CCLO1/H73510b_00.kdz</sw_url> pkg03.lime.gdms.lge.com/dn/downloader.dev?
<sw_locale_url/><sw_recommand_uri/><app_version/><app_url/>
<cs_em_flag>N</cs_em_flag>
<cs_em_uri>N</cs_em_uri>
<chip_type>EG</chip_type>
<prod_type>2</prod_type>
<buyer>SEA</buyer>
<file_name>H73510b_00.kdz</file_name>
</auth_model_check></response>
and yes its 5.1..
would be nice if theres a step by step guide cuz last phone i tired rooting was prolly galaxy tab and it was wayy easier :/

Ok, well done. Is 10b the same version as currently installed on your device?
Some other details would be interesting:
Do you have an unbranded device?
Where did you buy it / where do you live? (country)
Are you an advanced user? Do you know how to work with linux?
The next steps will be:
Calculate your dd parameters and backup your system partition into a img file. Read my guide:
[How to] Determine dd Parameters For All LG G4 Models
http://forum.xda-developers.com/g4/h...lg-g4-t3184867
Please post the outputs of gdisk into a HIDE and CODE tag.
Post your calculated dd parameters, so that we can verify it.
IMPORTANT: Keep the original (unchanged) system.img on your computer (zip it).
Then:
Copy the img file to a linux system and mount it. Create a testfile (test.txt) on the mounted system partition.
Copy the img file back to your phone and try to "dd" it back over your system partition.
Check if you see the testfile on your system partition.
If that worked you have successfully overwritten your system partition.
Then:
Try to inject root with the Inject_Root_G4.zip on your linux system.
Copy the new img file to your phone and "dd" it over your system partition.
Please ask if you are not 100% sure what to do.
You are responsible for what you are doing with your device.
Backup all your data (photos, videos, messages...) before going one step further.

dominik-p said:
Ok, well done. Is 10b the same version as currently installed on your device?
Some other details would be interesting:
Do you have an unbranded device?
Where did you buy it / where do you live? (country)
Are you an advanced user? Do you know how to work with linux?
The next steps will be:
Calculate your dd parameters and backup your system partition into a img file. Read my guide:
[How to] Determine dd Parameters For All LG G4 Models
http://forum.xda-developers.com/g4/h...lg-g4-t3184867
Please post the outputs of gdisk into a HIDE and CODE tag.
Post your calculated dd parameters, so that we can verify it.
IMPORTANT: Keep the original (unchanged) system.img on your computer (zip it).
Then:
Copy the img file to a linux system and mount it. Create a testfile (test.txt) on the mounted system partition.
Copy the img file back to your phone and try to "dd" it back over your system partition.
Check if you see the testfile on your system partition.
If that worked you have successfully overwritten your system partition.
Then:
Try to inject root with the Inject_Root_G4.zip on your linux system.
Copy the new img file to your phone and "dd" it over your system partition.
Please ask if you are not 100% sure what to do.
You are responsible for what you are doing with your device.
Backup all your data (photos, videos, messages...) before going one step further.
Click to expand...
Click to collapse
what do u mean 10b?
not really unbranded i guess? its a mid-tier version of the LG G4.. this is the phone.. http://www.lg.com/sg/mobile-phones/lg-G4-Beat
dont think its out at the US yet
bought it at Singapore as i recontacted my phone
nope i dont know how to use linux and im %100 not sure what to do :crying:

Ok so you are not a advanced user?
10b is the version of the kdz file. Goto Settings->Phone info->software version on your phone and post your software version.
First of all: It is not possible to root your phone without linux!
You don't have to install a linux on your computer (physically) but at least in an virtual environment (virtualbox, vmware player) or as a live distribution.
What you can do without linux is try to extract the GPT.
Which OS is installed on your computer (Win 7, 8, 10)?
Download the LG_Root.zip from
http://forum.xda-developers.com/android/development/guide-root-method-lg-devices-t3049772
It contains the Send_Command.exe
You need this tool to open a special console when your phone is in download mode.
Do you know this tool and how to enter the download mode?

dominik-p said:
Ok so you are not a advanced user?
10b is the version of the kdz file. Goto Settings->Phone info->software version on your phone and post your software version.
First of all: It is not possible to root your phone without linux!
You don't have to install a linux on your computer (physically) but at least in an virtual environment or as a live distribution.
What you can do without linux is try to extract the GPT.
Which OS is installed on your computer (Win 7, 8, 10)?
Download the LG_Root.zip from
http://forum.xda-developers.com/android/development/guide-root-method-lg-devices-t3049772
It contains the Send_Command.exe
You need this tool to open a special console when your phone is in download mode.
Do you know this tool and how to enter the download mode?
Click to expand...
Click to collapse
no im not an advanced user..
its software version is : V10b-SEA-XX
so i guess its a 10b?
im using windows 7 right now

Yes you have 10b installed now.
The XX means that it is unbranded.
SEA means southeast asia.
Win 7 is fine. Send_Command will work.
Download the zip from the above-mentioned thread.
Then:
Power off your device
When the device is powered off, hold volume up and insert a USB cable connected to the PC
Wait for the drivers to install
Click to expand...
Click to collapse
and follow the steps 7-9.

dominik-p said:
Yes you have 10b installed now.
The XX means that it is unbranded.
SEA means southeast asia.
Win 7 is fine. Send_Command will work.
Download the zip from the above-mentioned thread.
Then:
and follow the steps 7-9.
Click to expand...
Click to collapse
so i just download it, put it at desktop and skip all the methods till 6-9? do i have to enable developer mode before doing it?

No you don't need developer mode.
But it is no problem if you enabled it.
Are you able to open the console with Send_Command.exe?

dominik-p said:
No you don't need developer mode.
But it is no problem if you enabled it.
Are you able to open the console with Send_Command.exe?
Click to expand...
Click to collapse
i opened send_command.exe but it just closes back.. mine is at COM1 but idk how to change it
Update: it says NOTE: Do not attempt this on devices with 5.1.1 , at the time this method was posted it worked on many firmware 5.0.2 should i still go for it? im using 5.1.1

We won't follow the guide. We will do it like here:
http://forum.xda-developers.com/g4/orig-development/root-tmo-vzw-intl-variants-soon-root-lg-t3164765
(You will also find the thread is linked there.)
The thread is just a good help for the Send_Command tool.
You don't have to change the COM port.
Are you in download mode? Do you see the "Firmware Update" screen?
Use the ports.bat and note the "netdiag" COM port.
Inside of LG_Root folder hold shift and right click a blank space you should see "Open command window here"
Click to expand...
Click to collapse
Then enter:
Code:
Send_Command.exe \\.\COM#
Replace # with your number.

dominik-p said:
We won't follow the guide. We will do it like here:
http://forum.xda-developers.com/g4/orig-development/root-tmo-vzw-intl-variants-soon-root-lg-t3164765
(You will also find the thread is linked there.)
The thread is just a good help for the Send_Command tool.
You don't have to change the COM port.
Are you in download mode? Do you see the "Firmware Update" screen?
User ports.bat and note the "netdiag" COM port.
Then enter:
Code:
Send_Command.exe \\.\COM#
Replace # with your number.
Click to expand...
Click to collapse
Yup its in download mode i have the firmware update on my screen.. still to no avail i also installed LG driver and restarted.. opened send_command.exe it just closes back
or do i just enter the script after the # after special command? at because im now at this part http://i.imgur.com/fre9Z9l.png just that when i double-click send command it just closes back

dreamnoob said:
Yup its in download mode i have the firmware update on my screen.. still to no avail i also installed LG driver and restarted.. opened send_command.exe it just closes back
or do i just enter the script after the # after special command? at because im now at this part http://i.imgur.com/fre9Z9l.png just that when i double-click send command it just closes back
Click to expand...
Click to collapse
are you opening send command from the command prompt?

Do NOT double click on the Send_Command.exe
READ again:
Inside of LG_Root folder hold shift and right click a blank space you should see "Open command window here"
Click to expand...
Click to collapse
Then enter "Send_Command.exe \\.\COM#"

dominik-p said:
Do NOT double click on the Send_Command.exe
READ again:
Then enter "Send_Command.exe \\.\COM#"
Click to expand...
Click to collapse
oh okay means im on the right path..
so now i just do this as follows?
Type "id" and press enter (no quotes).
You should get back some text starting with "uid=(0)root gid=(0)root". If not, press CTRL-C, and do step 9 again (the application sometimes doesn't respond on the first command).
Run the command specified in the section below titled 'Commands to Run' to flash the rooted system image.
After a few minutes of sitting, you should get back a "#" prompt. This indicates the process has finished.
Type "LEAVE" (no quotes) and press enter. Your phone should reboot, and your phone will be rooted.

[! DISCONTINUED !] [TUTORIAL][LOCKED][UNLOCKED][ANY G4] DLM Backup

This thread is superseeded by: https://tinyurl.com/SALTatXDA
NO FURTHER SUPPORT HERE!
DLM Backup is a NANDROID BACKUP IN DOWNLOAD MODE!
(DLM Backup = [D]own[l]oad [M]ode Backup)
The following does not require an unlocked device and so even no TWRP.
Believe it or not but you are able to backup full partitions nevertheless!!! :victory:
.. and all this even for partitions you usually have NO ACCESS TO (e.g. laf, aboot etc) and all this even without root ! wtf its not a dream its true! :victory:
It's really awesome especially for those having a locked device but still wanted to have a nandroid backup
or for those encountering the ILAPO (Infinite Loop Auto Power off or just called "bootloop issue") wanting to save their data!
The following will make full disk dumps of all or only the system essential ones of your device. Choose whichever option you need.
Preparation
First of all you should download FWUL ( https://tinyurl.com/FWULatXDA ).
Every other Linux is fine as well as long as you can handle it! (do not expect support from me then - I support FWUL only)
You may still should consider FWUL as it has everything onboard and is preconfigured to work with Android devices out-of-the-box.
Keep in mind the FWUL password as you need it for the sudo commands within the terminal later.
Once FWUL is running open a terminal (little black icon in the panel):
Code:
git clone [url]https://github.com/steadfasterX/lglaf.git[/url]
cd lglaf
Leave this terminal window open - we need it in the next step.
Then boot your phone into download mode --> the following guide is 100% working and bulletproof:
take out battery and unplug USB cable
plugin USB cable to your PC (while battery ist still out)
wait until you see the missing battery icon (question mark within a battery symbol)
press Volume up and while keeping it pressed put battery in (take care that you do not press the power button)
keep pressing Volume up until you see "Download mode"
If that does not work for you try it this way instead:
unplug USB cable
power down device or pull out battery
put battery back
press Volume up and while keeping it pressed plugin USB cable to your PC (take care that you do not press the power button)
keep pressing Volume up until you see "Download mode"
Your phones screen should look similar to this afterwards:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
You need a USB stick or disk which is big enough to hold the backup.
Depending on the method you need either a ~8 GB one or a 64 GB..
Plugin the USB stick and find out the path to it by just double clicking on the USB stick icon which appears on the desktop after plugging in the stick.
Then write down / copy the path to the stick as shown in the screenshot:
If you encounter problems with the above (e.g. no icon appears after plugging in the USB stick) you can do this in a terminal instead:
Code:
df
Filesystem 1K-blocks Used Available Use%[COLOR="Red"] Mounted on[/COLOR]
dev 16439340 264744 16174596 2% /dev
[............]
/dev/sdd3 2978320 9532 2797780 1%[COLOR="red"] [B]/run/media/android/myusb-stick[/B][/COLOR]
When you are running LL you can skip this step but when you are on MM (or higher...) you need to do the following:
Execute this in your terminal left open from the "Preparation" topic:
Code:
sudo python2 auth.py
you should see something like:
LGLAF.py: DEBUG: Detaching kernel driver for intf 0
LGLAF.py: DEBUG: Using endpoints 83 (IN), 02 (OUT)
auth: DEBUG: Challenge: c0:45:6c:78
auth: DEBUG: Response: b4:1d:1e:cd:e8:f1:5f:b5:fa:78:9e:f8:2d:c6:83:86
Click to expand...
Click to collapse
Now you are authenticated with the download mode and we can continue:
Option A) FULL backup (includes everything e.g. system, cache and userdata / internal storage)
When to use:
if you want to flash new ROMs or bootloader stacks
if you want to backup all your internal storage (e.g. pictures, videos and stuff) - keep in mind TWRP does NOT backup your internal storage!!
if you want to have a real FULL NANDROID (e.g. TWRP will not backup partitions like misc, persistent, persistent-lg etc)
Requirements:
- FWUL
- a 64 GB or bigger USB stick / disk
Execute this in your terminal left open from the "Preparation" topic:
Code:
sudo python2 extract-partitions.py --max-size 0 -d [I]YOURUSBSTICKpath[/I]
(replace YOURUSBSTICKpath with the path you discovered in the Preparation topic!)
Be patient.. this can take a loooong time!
You can watch the progress e.g with executing this in a NEW terminal (just click the terminal icon in the panel again):
Code:
watch 'ls -lathr [I]YOURUSBSTICKpath[/I] | tail '
(replace YOURUSBSTICKpath with the path you discovered in the Preparation topic!)
Once finished you can reboot by either taking out the battery or typing:
Code:
sudo python2 lglaf.py --skip-hello -c '!CTRL RSET'
Option B) system essentials backup (does *NOT* include system, cache and userdata / internal storage!!)
When to use:
if you want to flash new bootloader stacks
if you want to backup your current lock/unlock state
if you want to backup your IMEI and EFS
Requirements:
FWUL
a 4 - 8 GB or bigger USB stick / disk
Execute this in your terminal left open from the "Preparation" topic:
Code:
sudo python2 extract-partitions.py -d [I]YOURUSBSTICKpath[/I]
(replace YOURUSBSTICKpath with the path you discovered in the Preparation topic!)
Be patient.. this can take some time!
You can watch the progress e.g with executing this in a NEW terminal (just click the terminal icon in the panel again):
Code:
watch 'ls -lathr [I]YOURUSBSTICKpath[/I] | tail '
(replace YOURUSBSTICKpath with the path you discovered in the Preparation topic!)
Once finished you can reboot by either taking out the battery or typing:
Code:
sudo python2 lglaf.py --skip-hello -c '!CTRL RSET'
... and the last 2 things which need to be done
1) Click the thanks button here
2) Enjoy
Restore a DLM Backup
Checkout Post #2 for the restore howto
Credits
Peter Wu for his absolutely awesome job on reverse engineering the LAF protocol and offering the lglaf code as python code.
Main thread for lglaf: https://forum.xda-developers.com/android/software-hacking/tool-lg-download-mode-laf-t3285946/page1
Donations: https://forum.xda-developers.com/member.php?u=4790426
.

Restore a previously taken backup or partitions of an already extracted KDZ
There are 2 methods available - choose the one matching your needs:
A) Restore a previously taken DLM Backup
B) Flash a KDZ / LGUP NG by sfX
Unfortunately this may not work on every firmware so you may try different firmwares then and you will receive the same error regarding communication port closing but in general it should work this way.
A) Restore a previously taken DLM Backup / Restore partitions from an extracted KDZ
To restore single partitions use the following
sudo python2 auth.py
sudo python2 partitions.py --restore /path/to/dumpfile partitionname
e.g.
sudo python2 auth.py
sudo python2 partitions.py --restore /tmp/misc misc (would restore the misc partition)
To restore ALL partitions in a folder
For this the best is to use the new LGUP NG kdzmanager which is explained in the next topic.
Install LGUP NG but skip the steps to extract a KDZ if you don't need it.
Then:
bash kdzmanager.sh --test --flash /path/to/imagefiles
(/path/to/imagefiles must contain your previously taken DLM backup files or an extracted KDZ)
This will just test flashing and not actually flash.
If that looks fine do it again but without --test parameter:
bash kdzmanager.sh --flash /path/to/imagefiles
B) Flash a KDZ / LGUP NG (next generation) by sfX
Forget LGUP to flash a KDZ from now on!
Just use my KDZManager
Features:
No worries anymore about those crappy DLL issues
Extract a KDZ
Test flashing partitions (dry run without actually flashing anything)
Flash partitions from a KDZ
when flashing avoid erasing/wiping userdata (keep your data between KDZ flashes)
Hint: not wiping userdata can occur in a bootloop when its not compatible with the ROM! So use that option with care.
will work on any Linux (but FWUL is the only supported)
Keep in mind that this is an early release and there are NO CHECKS like ARB or even if the device model matches with the KDZ but THIS WILL ALL COME (even with an option to override and flash regardless)
Roadmap:
GUI
Check for matching device model
Check for ARB
Instructions:
Boot FWUL (or your Linux but keep in mind that only FWUL is supported), choose language & login
Download the KDZ file you want to flash (we need to know the path later e.g. /home/android/Downloads/)
Open the folder LG
Connect device in download mode to the PC
Double click "LG laf NG" icon
Type in the new opened terminal:
sudo python2 auth.py
[*]sudo python2 partitions.py --list
If this lists your partitions then we can proceed with flashing.
Download my brand new kdzmanager tool in FWUL: (right click and save as)
When you are not using the persistent mode of FWUL: plug in a big USB stick (e.g. 32 GB or more) into FWUL and extract the attached file there
When you are using the persistent mode of FWUL: just extract it in your download folder
You need to know the full path so best is copying the path from the file manager (e.g. /home/android/Downloads/ ) or leave the file manager open there
Open another terminal (black little icon in the panel)
cd and directly behind this paste the path you copied (e.g. cd /home/android/Downloads/ )
press ENTER
bash kdzmanager.sh -x FILLINFULLPATH-TO-DOWNLOADED-KDZ
(e.g. bash kdzmanager.sh -x /home/android/Downloads/h811blablubb.kdz)
WARNING-1: Keep in mind that atm kdzmanager is not able to proof if you choose a compatible KDZ file for your device!
Check your device model and the KDZ twice!
WARNING-2: Keep in mind that atm kdzmanager is not able to proof your current ARB version so flashing an smaller ARB then your current one will BRICK your device.
Check ARB first: CLICK
If you understood the above 2 warnings proceed like this:
bash kdzmanager.sh --test --flash extracteddz/
(just like this as "extracteddz" is the path generated by the kdzmanager)
This will just test flashing and not actually flash. Let me know the results of this (copy & paste output)
if you can't wait the next step would be actually flashing ofc:
WARNING: by default the kdzmanager will not overwrite userdata (which would be like a factory reset) and I would recommend to leave it out always and better choose the LG factory reset menu (after flashing completed) if required. If you still want to flash it use --with-userdata as a parameter (can take a loooong time then btw).
bash kdzmanager.sh --flash extracteddz/
last step ( will be included in the next release): wipe your userdata:
sudo partitions.py --wipe userdata
Or just use the factory reset hardware key combo to do the same.
If you skip this step you may encounter a bootloop. If that happens you can at any time use the hardware key combo to boot into factory reset to fix that.
sfX

FAQ
1. Q: You get the error message: "Expected arrow in ls output" when executing lglaf
A: update to the latest version of lglaf (thx to @tulen_kobi for this patch!). For updating lglaf on FWUL check Q4.
If the error still persists your download mode version is not supported by lglaf. Its very likely that your carrier has a very strict policy activated in download mode. The only chance is to try other download mode version meaning to flash different KDZ files (on locked devices) or just the laf.img in fastboot (on unlocked devices).
On Nougat and when unlocked it is enough to just flash the laf.img of MM and you can use lglaf again.
2. Q: You get not an error but messages or files containing just "Hello, I am LAF. Nice to meet you."
A: your download mode version is not supported by lglaf. Its very likely that your carrier has a very strict policy activated in download mode. The only chance is to try other download mode version meaning to flash different KDZ files (on locked devices) or just the laf.img in fastboot (on unlocked devices).
On Nougat and when unlocked it is enough to just flash the laf.img of MM and you can use lglaf again.
3. Q: All seems fine but at the end of a command you see: "comm.call(close_cmd) [....someotherstuff...] Command failed with error code 0x8000010a"
A: This is known and not a serious issue. Once I have the time I will fix it but in the meanwhile pls ignore..
This has been fixed. please update your LGlaf like described in the next FAQ
4. Q: I want to update lglaf on FWUL v2 or higher
ok here is the correct way to achieve this on FWUL v2:
cd ~programs/lglafng/
git pull
git checkout g4
then you're up2date and can try again while in this folder!
sfX

I'm so happy that you were able to finally get this working. It's dumping my system partition right now. I'll report back when it's done.
Also. You should note that the sudo password is "linux" and to view progress on the dump, you should specify that the command should be opened in a new terminal window.
Over all. Awesome tutorial!
EDIT: Was able to retrieve 7gb of lost pictures thanks to this method! Thank you!

How to restore? Is it possible?

mateus.sc said:
How to restore? Is it possible?
Click to expand...
Click to collapse
Yes even that.. I will write down a restore guide soon.
.
Sent from my LG-H815 using XDA Labs

I cannot Auth with my device.
I get the first 2 lines from the auth.py command
No challenge or response.
Using Virtualbox.

OllieD said:
I cannot Auth with my device.
I get the first 2 lines from the auth.py command
No challenge or response.
Using Virtualbox.
Click to expand...
Click to collapse
what Android version is installed currently?
.

steadfasterX said:
what Android version is installed currently?
.
Click to expand...
Click to collapse
20G Stock Locked Bootloader.
Rebooted into live environment and worked.
Extract partitions errored out
Traceback (most recent call last):
File "extract-partitions.py", line 63, in <module>
main()
File "extract-partitions.py", line 60, in main
dump_partitions(comm, disk_fd, args.outdir, args.max_size * 1024)
File "/usr/lib/python2.7/contextlib.py", line 24, in __exit__
self.gen.next()
File "/home/android/lglaf/partitions.py", line 78, in laf_open_disk
comm.call(close_cmd)
File "/home/android/lglaf/lglaf.py", line 176, in call
raise RuntimeError('Command failed with error code %#x' % errCode)
RuntimeError: Command failed with error code 0x8000010a
After Dumping, Option B
Also the Firefox installer although it installs Firefox it wont launch and gives a SQLite Version Error so it will not run.
Chromium works fine.
Now i've backed up i can try and install V29

OllieD said:
20G Stock Locked Bootloader.
Rebooted into live environment and worked.
Extract partitions errored out
Traceback (most recent call last):
File "extract-partitions.py", line 63, in <module>
main()
File "extract-partitions.py", line 60, in main
dump_partitions(comm, disk_fd, args.outdir, args.max_size * 1024)
File "/usr/lib/python2.7/contextlib.py", line 24, in __exit__
self.gen.next()
File "/home/android/lglaf/partitions.py", line 78, in laf_open_disk
comm.call(close_cmd)
File "/home/android/lglaf/lglaf.py", line 176, in call
raise RuntimeError('Command failed with error code %#x' % errCode)
RuntimeError: Command failed with error code 0x8000010a
After Dumping, Option B
Also the Firefox installer although it installs Firefox it wont launch and gives a SQLite Version Error so it will not run.
Chromium works fine.
Now i've backed up i can try and install V29
Click to expand...
Click to collapse
well it sounds like u have not much RAM attached to your VM then. 4 GB are recommended.
The dump error can be ignored as long as auth.py has worked before and everything gets dumped..
.

steadfasterX said:
Just a quick note:
I completely re-worked the guide and fixed an issue for devices running MM!
Just re-do the guide if you encountered an issue before.
.
Click to expand...
Click to collapse
what if .. i dont have USB.? am planning of backing up my IMEI. as i been reading this on the new N roms..
what can i do.?

raptorddd said:
what if .. i dont have USB.? am planning of backing up my IMEI. as i been reading this on the new N roms..
what can i do.?
Click to expand...
Click to collapse
If you have an unlocked device you have luck and you could use dd commands in TWRP. I know that yours is unlocked so you could use dd on every partition available on your device.
Tbh the most important seems to be persistent, fsg, misc but until I know for sure I would just backup EVERY partition. It's only needed once in the phones life usually so it doesn't hurt..
I need to have my device repaired before I can test it further so this can take a while.. Until then the backup of every partition is the best choice.
if the device is locked and on LL then TWRP in FIsH plus the mentioned dd commands can be used as well. I would still recommend the download mode backup though..
if the device is locked and on MM or N (haven't tested N in download mode though) then USB plus download mode is the only choice.
.
Sent from my LG-H815 using XDA Labs

Similar question. What's the quick and dirty way to backup these partitions from terminal app / busybox?
Dd if=??? Etc
not sure if different between models but mines h815 international running 'stock' nougat

steadfasterX said:
If you have an unlocked device you have luck and you could use dd commands in TWRP. I know that yours is unlocked so you could use dd on every partition available on your device.
Tbh the most important seems to be persistent, fsg, misc but until I know for sure I would just backup EVERY partition. It's only needed once in the phones life usually so it doesn't hurt..
I need to have my device repaired before I can test it further so this can take a while.. Until then the backup of every partition is the best choice.
if the device is locked and on LL then TWRP in FIsH plus the mentioned dd commands can be used as well. I would still recommend the download mode backup though..
if the device is locked and on MM or N (haven't tested N in download mode though) then USB plus download mode is the only choice.
.
Sent from my LG-H815 using XDA Labs
Click to expand...
Click to collapse
OMG so basically if this works in locked N, can I flash the korean v30 kdz and then restore a backup the modem.img from v29a made for my H815 with this method?
The possibilities are amazing

obvious said:
Similar question. What's the quick and dirty way to backup these partitions from terminal app / busybox?
Dd if=??? Etc
not sure if different between models but mines h815 international running 'stock' nougat
Click to expand...
Click to collapse
I will add it in the TWRP thread ASAP
mateus.sc said:
OMG so basically if this works in locked N, can I flash the korean v30 kdz and then restore a backup the modem.img from v29a made for my H815 with this method?
The possibilities are amazing
Click to expand...
Click to collapse
Technically this method can provide that (as said I can't test N atm though so I don't know if this works in general for N but if LG hasn't changed anything.. )
but:
keep in mind that cross flashing partitions can result in a soft brick on locked devices!! I don't know how N behaves here tbh so it may just work or it may soft brick in the specific case of modem.
So it would be nice to have someone trying to use the auth command on a N bootloader stack. This will not harm anything but then we know for sure if this is usable for N or not
.
Sent from my LG-H815 using XDA Labs

steadfasterX said:
If you have an unlocked device you have luck and you could use dd commands in TWRP. I know that yours is unlocked so you could use dd on every partition available on your device.
Tbh the most important seems to be persistent, fsg, misc but until I know for sure I would just backup EVERY partition. It's only needed once in the phones life usually so it doesn't hurt..
I need to have my device repaired before I can test it further so this can take a while.. Until then the backup of every partition is the best choice.
if the device is locked and on LL then TWRP in FIsH plus the mentioned dd commands can be used as well. I would still recommend the download mode backup though..
if the device is locked and on MM or N (haven't tested N in download mode though) then USB plus download mode is the only choice.
.
Sent from my LG-H815 using XDA Labs
Click to expand...
Click to collapse
yes unlocked.. i downloaded FWUL but on step to place the command for python i had directiry not found and gave up use twrp for EFS.
for DD what are commands is this using ternimal? where can i find all the command to extract say boot ,system modem ect.?

raptorddd said:
yes unlocked.. i downloaded FWUL but on step to place the command for python i had directiry not found and gave up use twrp for EFS.
for DD what are commands is this using ternimal? where can i find all the command to extract say boot ,system modem ect.?
Click to expand...
Click to collapse
just try my new twrp version which will be uploaded in 5 minutes..
.

Hey I'm getting an error in running this - phone is in download mode and connected. Using FWUL on my machine and trying to dump to an extrernal HD (path below in first line).
Code:
[[email protected] lglaf]$ sudo python2 extract-partitions.py --max-size 0 -d /run/media/android/16a064ee-96de-4c4d-8c30-29cbcc2e5441/
Traceback (most recent call last):
File "extract-partitions.py", line 63, in <module>
main()
File "extract-partitions.py", line 60, in main
dump_partitions(comm, disk_fd, args.outdir, args.max_size * 1024)
File "extract-partitions.py", line 24, in dump_partitions
parts = partitions.get_partitions(comm)
File "/home/android/lglaf/partitions.py", line 41, in get_partitions
assert arrow == '->', "Expected arrow in ls output"
AssertionError: Expected arrow in ls output

ReeS86 said:
Hey I'm getting an error in running this - phone is in download mode and connected. Using FWUL on my machine and trying to dump to an extrernal HD (path below in first line).
Click to expand...
Click to collapse
Yea... I saw that on another phone as well. Weird.
I need your help to fix it..
Could you come into IRC on Monday?
sfX
Sent from my LG-H815 using XDA Labs

steadfasterX said:
Yea... I saw that on another phone as well. Weird.
I need your help to fix it..
Could you come into IRC on Monday?
sfX
Sent from my LG-H815 using XDA Labs
Click to expand...
Click to collapse
Ya I'll try to pop on after work. Can also see if the secure boot thing works once I get that backup.

Add L24 LTE bands to BND-L22 or BND-AL10?

Just got the phone bootloader unlocked (thanks to Wh1t3Rose for the guide) and now need to add the LTE bands from L24. Settings > About says the model is BND-AL10, however, HCU client says it's BND-L22 so a little confused. Can't find any fw in firmware finder for L22 so assuming AL10 is the right model.
Can I now safely use HuRUpdater to flash BND-L24C567CUSTC567D1B344 (8.0.0.344) FullOTA-MF on this device? Or I am missing some steps like rooting / installing TWRP etc.?
Another question - what TWRP to use with HuRUpdater? Would the first one from here work for 7x?
Thanks for any comments!

rexian said:
Just got the phone bootloader unlocked (thanks to Wh1t3Rose for the guide) and now need to add the LTE bands from L24. Settings > About says the model is BND-AL10, however, HCU client says it's BND-L22 so a little confused. Can't find any fw in firmware finder for L22 so assuming AL10 is the right model.
Can I now safely use HuRUpdater to flash BND-L24C567CUSTC567D1B344 (8.0.0.344) FullOTA-MF on this device? Or I am missing some steps like rooting / installing TWRP etc.?
Another question - what TWRP to use with HuRUpdater? Would the first one from here work for 7x?
Thanks for any comments!
Click to expand...
Click to collapse
If you need to change model bands , it takes more than that.
If you do like that , the model number doesn't change and modem bands also stay the same. You will need to do what is referred to as "re-brand" which changes the oeminfo file , then flash the l24 full ota.
Changing the oeminfo. Makes bootloader lock again. But the same key is supposed to still work.
It can be easy to make brick during re-brand
. You should Study the bnd-hwota-eng script to understand the process.

mrmazak said:
If you need to change model bands , it takes more than that.
If you do like that , the model number doesn't change and modem bands also stay the same. You will need to do what is referred to as "re-brand" which changes the oeminfo file , then flash the l24 full ota.
Changing the oeminfo. Makes bootloader lock again. But the same key is supposed to still work.
It can be easy to make brick during re-brand
. You should Study the bnd-hwota-eng script to understand the process.
Click to expand...
Click to collapse
Thanks mrmazak. Is this a viable option of getting L24 bands on AL10?

Found the L24 oeminfo here. Is there a way I can backup the oeminfo from my AL10 just in case I brick it
Maybe installing TWRP and taking a full backup is a better idea but can't find a TWRP img for AL10 Naugat :|

rexian said:
Found the L24 oeminfo here. Is there a way I can backup the oeminfo from my AL10 just in case I brick it
Maybe installing TWRP and taking a full backup is a better idea but can't find a TWRP img for AL10 Naugat :|
Click to expand...
Click to collapse
I will look at it tonight when I get home.
I had found good hwota tool with the re-brand script in it. I had to translate from russain and add L24 oeminfo but ithas been used successfully.
I will look at that linked oeminfo and compare to the one I put in the hwota tool.
A search on the 7x main page for "bnd hwota- eng" or similar should show the tool like.
If you don't find Ivan upload again.

mrmazak said:
I will look at it tonight when I get home.
I had found good hwota tool with the re-brand script in it. I had to translate from russain and add L24 oeminfo but ithas been used successfully.
I will look at that linked oeminfo and compare to the one I put in the hwota tool.
A search on the 7x main page for "bnd hwota- eng" or similar should show the tool like.
If you don't find Ivan upload again.
Click to expand...
Click to collapse
Thanks again, mrmazak. I saw your post in the other thread while searching but wasn't sure if there is more up to date information or an alternate tool.
Is it possible to just add certain bands to a model without removing existing bands? The only bands of interest are LTE 12 and 17 that are missing in this. The person doesn't really care about Oreo or Nougat - as long as it works with AT&T

Thanks mrmazak for updating HWTOA. I'll try rebranding AL10 to L24 tomorrow. Don't see a way to just add new bands so rebranding L24 seems to be the only way for now.
BTW, I took a backup of Boot, OEMInfo, System and modem_fw partitions. For some reason backup of Data partition failed after multiple attempts (unable to find partition for path /system and createTarProcess() ended with error 255). Is Data partition important in this case? The phone has no real data or app installed anyway as it's not in use.
Another question - planning to use HWOTA7 since I have Nougat right now but downloaded BND-L24C567CUSTC567D1B344 (8.0.0.344) full OTA - is this ok? I can't find a Nougat version for L24C567.

I flashed from L21C10 to TL10,before that I saved 8 modem files with L21 to him and the emui tweaker from the phone,then I restored it,and I had 4G+,try so.

rexian said:
Thanks mrmazak for updating HWTOA. I'll try rebranding AL10 to L24 tomorrow. Don't see a way to just add new bands so rebranding L24 seems to be the only way for now.
BTW, I took a backup of Boot, OEMInfo, System and modem_fw partitions. For some reason backup of Data partition failed after multiple attempts (unable to find partition for path /system and createTarProcess() ended with error 255). Is Data partition important in this case? The phone has no real data or app installed anyway as it's not in use.
Another question - planning to use HWOTA7 since I have Nougat right now but downloaded BND-L24C567CUSTC567D1B344 (8.0.0.344) full OTA - is this ok? I can't find a Nougat version for L24C567.
Click to expand...
Click to collapse
There is a nougat full it's. It is labeled for Oreo roll-back. But should work for you . It is found as 'bond' intead of 'bnd'. ( Wait, the rebrand script is looking for three files. I will try and adjust the script to not fault out with just two.)
And link is actually in the hwota thread as a downgrade package.
I do reupload most current hwota file yesterday. I found a bug when I did a downgrade. So I proof read through the files again and re-uploaded.
Also added link to bnd-hwota-eng to the guide thread.

Klirensxp said:
I flashed from L21C10 to TL10,before that I saved 8 modem files with L21 to him and the emui tweaker from the phone,then I restored it,and I had 4G+,try so.
Click to expand...
Click to collapse
Did you do this to rebrand the phone to support other LTE bands? Or just to get OTA updates keeping the same radios? Sounds like latter.
I am trying to get the US radio bands on my AL10 by rebranding it to L24.

mrmazak said:
There is a nougat full it's. It is labeled for Oreo roll-back. But should work for you . It is found as 'bond' intead of 'bnd'. ( Wait, the rebrand script is looking for three files. I will try and adjust the script to not fault out with just two.)
And link is actually in the hwota thread as a downgrade package.
I do reupload most current hwota file yesterday. I found a bug when I did a downgrade. So I proof read through the files again and re-uploaded.
Also added link to bnd-hwota-eng to the guide thread.
Click to expand...
Click to collapse
Ok, will wait for the updated script. I downloaded rest of the files.
In the oeminfo folder I see AL10C00 img but not AL10C675. Trying to root the phone to be able to copy custom.bin/oeminfo so that I can go back to stock later. For some reason SuperSU doesn't work... will try Magisk now

rexian said:
Ok, will wait for the updated script. I downloaded rest of the files.
In the oeminfo folder I see AL10C00 img but not AL10C675. Trying to root the phone to be able to copy custom.bin/oeminfo so that I can go back to stock later. For some reason SuperSU doesn't work... will try Magisk now
Click to expand...
Click to collapse
I have been looking at some ways to edit the script to make it automatically adjust if there is only 2 update files. And it will be easier to just manually edit the one script before you run it.
Add a "#" to the front of line 332 of hwota.sh.
"HWOTA_BND\HWOTA7_BND-eng\hwota.sh"
Need to just comment out the line with "$TARGET_UPDATE_DATA"
Code:
echo
echo "Copying recovery files, please be patient and wait...."
$ADB push $RECOVERY $RECOVERY_TMP
$ADB push $RECOVERY2 $RECOVERY2_TMP
$ADB shell "dd if=$RECOVERY_TMP of=/dev/block/bootdevice/by-name/recovery bs=1048576"
$ADB shell "dd if=$RECOVERY2_TMP of=/dev/block/bootdevice/by-name/recovery2 bs=1048576"
$ADB shell "echo --update_package=$TARGET_UPDATE > /cache/recovery/command"
#$ADB shell "echo --update_package=$TARGET_UPDATE_DATA >> /cache/recovery/command"
$ADB shell "echo --update_package=$TARGET_UPDATE_HW >> /cache/recovery/command"
$ADB reboot recovery
$ADB kill-server

mrmazak said:
I have been looking at some ways to edit the script to make it automatically adjust if there is only 2 update files. And it will be easier to just manually edit the one script before you run it.
Add a "#" to the front of line 332 of hwota.sh.
"HWOTA_BND\HWOTA7_BND-eng\hwota.sh"
Need to just comment out the line with "$TARGET_UPDATE_DATA"
Code:
echo
echo "Copying recovery files, please be patient and wait...."
$ADB push $RECOVERY $RECOVERY_TMP
$ADB push $RECOVERY2 $RECOVERY2_TMP
$ADB shell "dd if=$RECOVERY_TMP of=/dev/block/bootdevice/by-name/recovery bs=1048576"
$ADB shell "dd if=$RECOVERY2_TMP of=/dev/block/bootdevice/by-name/recovery2 bs=1048576"
$ADB shell "echo --update_package=$TARGET_UPDATE > /cache/recovery/command"
#$ADB shell "echo --update_package=$TARGET_UPDATE_DATA >> /cache/recovery/command"
$ADB shell "echo --update_package=$TARGET_UPDATE_HW >> /cache/recovery/command"
$ADB reboot recovery
$ADB kill-server
Click to expand...
Click to collapse
Cool, done commenting #332. Also was able to root and make a copy of custom.bin / oeminfo.
Now, going to run the script :fingers-crossed:

Alright, an update - it went through lot of steps as expected (including installing oeminfo and unlocking the bootloader) but ended up with "software update failed" error on the phone. On command prompt here is the last few lines of the log -
Use the volume buttons to select YES and press the power button
...
(bootloader) The device will reboot and do factory reset...
OKAY [ 11.001s]
finished. total time: 11.001s
Wait for the device to boot into TWRP.
Press Enter to continue...
Wait for the files to load. Neither of which you do not need to press !!!.
Copying is in progress ....
[100%] /data/update/HWOTA/update.zip
Copying is in progress ....
adb: error: cannot stat 'D:/UX/HCU-Client/HWOTA7_BND-eng//update/update_data_public.zip': No such file or directory
Copying is in progress ....
adb: error: cannot stat 'D:/UX/HCU-Client/HWOTA7_BND-eng//update/update_all_hw.zip': No such file or directory
Copying recovery files, please be patient and wait....
[100%] /tmp/BND_RECOVERY_NoCheck.img
[100%] /tmp/BND_RECOVERY2_NoCheck.img
35+1 records in
35+1 records out
37109760 bytes (35.4MB) copied, 0.414091 seconds, 85.5MB/s
35+1 records in
35+1 records out
37109760 bytes (35.4MB) copied, 0.508804 seconds, 69.6MB/s
The system update should start automatically.
Press Enter to continue...
Click to expand...
Click to collapse
Error for update_data_public.zip was expected and on close inspection I noticed there was an extra '.' in the name of update_all_hw.zip. It was update_all_hw..zip.
So, fixed it and put the phone in fastboot mode and re-ran update.bat. It installed recovery and asked me to put into TWRP. I tried but it never went to TWRP started installing the previously copied ZIP files. It took a while but after it restarted, it went to straight to Android (YAY!). Went to Settings > About and say the model as BND-L24 and build number System 5.1.0.98(07DV).
So far it seemed everything was fine - then I inserted the FreedomPop SIM (uses AT&T towers), added the fp.com.attz APN and restarted it - AND the same issue, can't see the carriers and 0 bars
The oeminfo was definitely installed as I see a lot more options in "preferred network mode" but selecting Global or LTE or anything else does nothing...
Since I am not able to boot into TWRP, I wonder if that's causing an issue. Every attempt to boot into TWRP goes into a screen showing "installing update" with 5% status. It eventually (after 10 minutes or so) boots into Nougat.

Gave up and started from scratch (after installing TWRP img mount manually) and it completed successfully (with expected error for the missing update_data_public.zip). Build number changed to BND-L24C567B150 so both zips were installed yet the problem remains the same - no cellular connectivity and settings > More > Mobile Network > Carrier remains disabled...

rexian said:
Did you do this to rebrand the phone to support other LTE bands? Or just to get OTA updates keeping the same radios? Sounds like latter.
I am trying to get the US radio bands on my AL10 by rebranding it to L24.
Click to expand...
Click to collapse
It’s just that the L21 is always 4G,and on the TL10 it goes to 3G,I switched from L21 to TL10 because of gestures, now I have 4G+ as well as on L21.

rexian said:
Gave up and started from scratch (after installing TWRP img mount manually) and it completed successfully (with expected error for the missing update_data_public.zip). Build number changed to BND-L24C567B150 so both zips were installed yet the problem remains the same - no cellular connectivity and settings > More > Mobile Network > Carrier remains disabled...
Click to expand...
Click to collapse
Good catch with the renamed file. You did right thing to start over, because that first build number was not correct.
As far as I know this should have changed the radio files (modem).
I will keep looking for other confirmed way to change the selected bands.

mrmazak said:
Good catch with the renamed file. You did right thing to start over, because that first build number was not correct.
As far as I know this should have changed the radio files (modem).
I will keep looking for other confirmed way to change the selected bands.
Click to expand...
Click to collapse
Thanks mrmazak. What could be the reason behind disabled option? Earlier with AL10, I could go inside and see AT&T listed but selecting that would not help as corresponding radios were not enabled in AL10.
Now, even if L24 radios are not properly installed / enabled, I should be able to go inside and see AT&T listed - makes me wonder if all the radios are now disabled.
Is there another way to check what radios are available in a phone by running some app?

rexian said:
Thanks mrmazak. What could be the reason behind disabled option? Earlier with AL10, I could go inside and see AT&T listed but selecting that would not help as corresponding radios were not enabled in AL10.
Now, even if L24 radios are not properly installed / enabled, I should be able to go inside and see AT&T listed - makes me wonder if all the radios are now disabled.
Is there another way to check what radios are available in a phone by running some app?
Click to expand...
Click to collapse
Not sure about other ways to check the bands. There are playstore apps that will show what band you are connected to, but have not seen one that shows which ones you can connect to.
side note::: Funkyhuawei (paid service) says of there rebrand guide, that you must flash the new firmware at least 2 times. So maybe take the flash one more time.
some general questions about your problem.
On about phone screen, what is shown for 'baseband' ?
does the imei # number show?
are you installing sim into slot #1 ? (#2 does not support 4g)
did you verify freedom pop sim is activated? (tested in other device)
edit:
found few posts in some "rebranding" threads, that say what you want to do might not be possible.
They say on the software side it will have drivers for the correct bands. But he hardware may not suppport it.
here:
https://forum.xda-developers.com/showpost.php?p=76462513&postcount=175

mrmazak said:
Not sure about other ways to check the bands. There are playstore apps that will show what band you are connected to, but have not seen one that shows which ones you can connect to.
side note::: Funkyhuawei (paid service) says of there rebrand guide, that you must flash the new firmware at least 2 times. So maybe take the flash one more time.
Click to expand...
Click to collapse
I tried once more tonight but the same result - no service and carrier disabled.
mrmazak said:
some general questions about your problem.
On about phone screen, what is shown for 'baseband' ?
does the imei # number show?
are you installing sim into slot #1 ? (#2 does not support 4g)
did you verify freedom pop sim is activated? (tested in other device)
Click to expand...
Click to collapse
There are 2 long numbers for the baseband - both start with 21C60B. Yes, both IMEIs show and are the same as before.
Yes, I always used the dedicated SIM slot as I have a micro-SD inserted for backup.
mrmazak said:
edit:
found few posts in some "rebranding" threads, that say what you want to do might not be possible.
They say on the software side it will have drivers for the correct bands. But he hardware may not suppport it.
here:
https://forum.xda-developers.com/showpost.php?p=76462513&postcount=175
Click to expand...
Click to collapse
I am inclining towards this as well - possibly missing hardware
Now, how do I get back to AL10C675 (don't see a Nougat option in FW Finder) and original radio? HWOTA doesn't have C675 as option, it has C00. I do have the original custom.bin and oeminfo but how do I create a zip to install with TWRP?

[Guide] Make the Korean Q Great Again [relocalise, volte, wowifi, debloat and more]

IF YOUR BOOTLOADER IS NOT ALREADY UNLOCKED, THIS GUIDE IS NOT FOR YOU.
READ EVERYTHING AT LEAST ONCE BEFORE PROCEEDING!
THIS GUIDE WORKED GREAT FOR AT LEAST 3 PERSONS, THIS DOESN'T MEAN IT WILL WORK ON YOUR PHONE.
This guide exist in case the ULM Q never released
This guide should do the following :
relocalize to your country (I'm only providing the files for canada, usa and eu)
Root and TWRP (useful if any custom roms get released)
debloating
volte/vowifi/vilte/viwifi
Very Good battery (see screenshots down below)
mute shutter camera
4k 60fps video recording (?some people said it wasn't available on the korean Q?)
wifi tethering
and more
WHAT'S NOT WORKING FOR ME :
lg smartworld : meaning no lg app update.. which can lead to the next problem
Drag down for search : working only if you do not update the google app
What you need:
1 to 2hrs of free time
Working QFIL with minimal knowledge
Working Fastboot on your pc (See spoilers)
I did NOT manage to make fastboot work on my amd ryzen pc (3600)
here's what I tried :
- multiple fastboot drivers
(fastboot was kinda working.. now it just never load any driver)
- plugged in a usb 3.0 hub
- FWUL : https://forum.xda-developers.com/an.../live-iso-adb-fastboot-driver-issues-t3526755
(the latest version as of 2020-11-25 couldn't even boot on this pc...)
- ubuntu
(crashed the phone to a gray screen)
- all my usb ports : 2, 3 and 3.1​ What I didn't try but could work for you:
- plugged in a usb 2.0 hub
- linux mint?​
Soo... what did I do? I went back to my good ol' intel pc running windows 10 worked like a charm.
Click to expand...
Click to collapse
Also, this guide assume you had working volte/vowifi on your phone at some point...
Because, you will need the carrier folder from the /oem/op/ folder.. should look like this : open_us, vrz_us, open_ca..
Or you will need to retrieve it from your working firmware...
I'll be providing :
- Android 10 - G7 - OPEN_CA (Canadian operator folder) (What I'm using on my phone right now)
- Android 9 - V35 - OPEN_US (ULM/GFi) (Confirmed working by @cmrntnnr)
- Android 10 - G7 - OPEN_EU (untested) (thanks @vlad48)
!!!!!! Before crossflashing to the korean kdz !!!!!!
------------------------------------------------------------------------
Crossflashing can break stuff sometime.. it is advised to do a full backup of your phone using https://github.com/bkerler/edl
if you're feeling lucky and do not want to do a full backup... you should still use qfil to atleast backup the following VITAL partitions : Fsg, modem, modemst1&2, ftm
STORE THOSE FILES PRECIOUSLY
------------------------------------------------------------------------
File you need to download :
To your phone SDCARD :​
OPEN_CA or OPEN_US or OPEN_EU (untested) (Decompress this file, delete the zip)
OPEN_CA is too big, I had to delete apks that weren't from my carrier. (Bell)
(open_ca/apps/ -> kept only bell apks)
debloated-priv-app-RENAME-ME.zip (Decompress this file, delete the zip)
debloated-app-RENAME-ME.zip (Decompress this file, delete the zip)
twrp-installer-v3.3.1-v35_a.zip
Disable_Dm-Verity_ForceEncrypt_11.02.2020.zip
Magisk
(OPEN_EU only) : voenabler-v1.8.zip
​To your pc:​
vbmeta.img
30b_boot_magisk.img
30b_abl.bin (shouldn't be needed, but provided as backup)
Korean Q 30b (I went with LGU_KR since the other one weren't available back then)
The V35 engineering abl you got from here : https://forum.xda-developers.com/lg-v35/development/bootloader-unlock-root-instruction-t4052145
This file was renamed to engabl.bin in this guide​
You need to use SOLID EXPLORER, not esfile or any other since I can not guaranteed it will apply the correct permission to the files and folder.
LGUP > Flash V350N30b_00_LGU_KR_OP_1015.KDZ using partition DL, select everything except FTM
Let the phone boot for the first time and reach setup screen
LGUP > refurbish phone using the kdz (this should fix potential nt error when booting the phone, it did for me)
Let the phone boot for the first time and setup the phone quickly so you can install app. (no lock or fingerprint)
Patching vbmeta to edit the operator/carrier information & patching boot for magisk/root
QFIL > partition manager > abl_a > read, store that file and name it : needed_abl.bin
How to retrieve the file: WIN+R , %AppData%/Qualcomm/QFIL , enter, pick right folder, save and rename bin file​
QFIL > partition manager > abl_a > load > engabl.bin (for fastboot)
QFIL > partition manager > abl_b > load > engabl.bin (for fastboot) (Optional)
This is useful in case you need fastboot in the future, simply boot twrp then change slot from a to b and reboot.
To switch back from fastboot : fastboot --set-active=a​
reboot the phone using vol- + power
command :
Code:
fastboot --disable-verity --disable-verification flash vbmeta_a vbmeta.img
fastboot oem edl
QFIL > partition manager > abl_a > load > needed_abl.bin
QFIL > partition manager > boot_a > load > boot_magisk.img
reboot by holding vol- + power
[*]
Click to expand...
Click to collapse
Reboot to system, Install magisk manager and solid explorer
Start magisk manager and let it reboot your phone
magisk > modules > install from storage > twrp-installer-v3.3.1-v35_a.zip
SOLID EXPLORER > copy the carrier folder to the oem/op/ partition ('OPEN_CA' in my case)
SOLID EXPLORER > edit oem/op/cust_path_mapping.cfg and replace LGU_KR with OPEN_US ('OPEN_CA' in my case)
If you're still getting nt error at boot, you'll have to fix it in order to make the phone load open_us..
try adding a second line like this :
FFFFFF,84=/oem/OP/OPEN_US
If this doesnt do it, you'll have to share your nt error in the comment.
Click to expand...
Click to collapse
SOLID EXPLORER > Rename the folder /oem/op/LGU_KR to LGU_KRori (this will make your phone lag/glitch/freeze real quick.. proceed with the next step ASAP)
Quickly go in magisk and use the reboot menu to get to twrp. (reboot to recovery)
Format data
Reboot to TWRP/recovery
Flash Magisk-v21.1.zip, if it doesn't flash, reboot using the reboot menu to TWRP/recovery again until it works. (no red text)
Flash Disable_Dm-Verity_ForceEncrypt_11.02.2020.zip
Reboot to system
if the vowifi toggle is not working for you
For OPEN_CA/OPEN_US :
SOLID EXPLORER > move debloated-priv-app-RENAME-ME to /oem/op/priv-app/
SOLID EXPLORER > Rename the new folder to OPEN_US or OPEN_CA
Reboot
Click to expand...
Click to collapse
FOR OPEN_EU : (these steps are from the v40 community telegram, Quote from Lucky)
magisk > modules > install from storage > voenabler-v1.8.zip
If you transplant the KR OP with OPEN_EU, and are based in EU, this module should add the props that enables the VoLTE and VoWifi options.
Only if this fails, do you need to tinker with the xml files.
Click to expand...
Click to collapse
Optional.
Adding back missing lg apps (I provide QMemo and LG Weather)
you can either install manually the apk from debloated-app-RENAME-ME
or
move the folder to oem/op/app/ and rename it OPEN_CA or OPEN_US
Click to expand...
Click to collapse
Enable LGMessage over Google message and add back LGFMRadio (you'll need to uninstall any sms app you might have installed.. like google message or fb messenger(if used for sms))
Solid Explorer
edit this file /oem/op/open_us/config/custom_apk_list.cfg
change the sign on the following lines (from - to + and + to -)
-com.lge.fmradio:/system/product/priv-app/LGFmRadio
-com.android.mms:/system/product/priv-app/LGMessage
-/system/app/SmartMessagingEngine
+com.google.android.apps.messaging:/system/app/Messages
Example
-/system/app/SmartMessagingEngine
to
+/system/app/SmartMessagingEngine
Reboot
Click to expand...
Click to collapse
Do not forget to enable developer option and adb AND
Plug you phone in computer, open adb shell and type su
on the phone, grant root.
It is useful to have a root shell in case the phone is stuck while booting (not boot looping)
you can also just reboot to twrp and undo your modification from there.
Click to expand...
Click to collapse
Thanks to everyone patient enough to answer my questions and who did provide most of the solution for this guide:
vlad48, Lucky, azitlies, xsavi, kaneorotar and many more..

Thanks for the guide

alonzo_ama26 said:
Thanks for the guide
Click to expand...
Click to collapse
No prob!
Added OPEN_EU files, but they are untested.. no clue if everything will work... Some people in the v40 community got it to work
Good luck everyone

I've completed all the steps (except for lg weather) and I didn't notice anything different in call features until I saw the description of the international roaming setting referenced "outside of US PR etc." instead of "outside of foreign territory or whatever" which indicates a success.
Then I Applied the vomaster.zip from somewhere else (prob the same thing as the OP's not sure) and flipped on wificalling on the settings and got the setup prompt for wificalling from my carrier and later a "wifi setup's been completed" notification, so I guess things are finally good again. Unfortunately RCS doesn't seem to want to cooperate either way =\
Not sure why I did it because korean q on its own was usable, but I did it it anyway and it is nice, performance feels better too but this could be because I went from LG firmware to open_us. Both the incoming and outgoing calls and texts feel much snappier as well and doesn't take 5 seconds to go anywhere. Also it doesn't ask me whether I want to listen to the call recording or not at the end of every phonecalls so that's nice. thank you
-edit
one question, is there any way I can use the korean AOD's? I liked the one that shows calendar and time.

issc said:
I've completed all the steps (except for lg weather) and I didn't notice anything different in call features until I saw the description of the international roaming setting referenced "outside of US PR etc." instead of "outside of foreign territory or whatever" which indicates a success.
Then I Applied the vomaster.zip from somewhere else (prob the same thing as the OP's not sure) and flipped on wificalling on the settings and got the setup prompt for wificalling from my carrier and later a "wifi setup's been completed" notification, so I guess things are finally good again. Unfortunately RCS doesn't seem to want to cooperate either way =\
Not sure why I did it because korean q on its own was usable, but I did it it anyway and it is nice, performance feels better too but this could be because I went from LG firmware to open_us. Both the incoming and outgoing calls and texts feel much snappier as well and doesn't take 5 seconds to go anywhere. Also it doesn't ask me whether I want to listen to the call recording or not at the end of every phonecalls so that's nice. thank you
-edit
one question, is there any way I can use the korean AOD's? I liked the one that shows calendar and time.
Click to expand...
Click to collapse
odd! you really shouldn't have to flash that vomaster.zip at all if you're located in the US.. honestly.. I don't even know if rcs is available in canada and I'm really not sure how to test this feature.. You might have to toggle wifi calling again if you got the wifi calling activation success notification.. it was the case on my friend phone..
Just to confirm...
volte/vowifi working?
ulm or awm?
carrier?
Looks like the calendar is available with the open_ca files... not sure for the open_us.. sorry..

[ATTACH

cloud1250000 said:
The V35 engineering abl you got from here : https://forum.xda-developers.com/lg-v35/development/bootloader-unlock-root-instruction-t4052145
This file was renamed to engabl.bin in this guide​
Click to expand...
Click to collapse
That file is a zip file with two different files in it, do you mean to rename this zip file to engabl.bin?

After step 5 I started to get some weird outputs.
fastboot.exe oem edl
FAILED (Status read failed (Too many links))
fastboot: error: Command failed
Click to expand...
Click to collapse
Seems like that output is normal because I have the rom rooted and twrped right now but I did have to change the active slot to B at this point because otherwise QFIL wasn't able to read the partitions afterwards. Oddly enough that was the only change I had to make, every other command worked as is referencing abl_a even though I changed the active slot to B (and when I flipped the steps to target slot B instead I just got bootlooped).
Everything's looking good so far. I had not been able to setup twrp on this phone so that's welcome. Hotspot wasn't working on Oreo either so that's another good improvement at least for me. Hopefully, this update ends up being a little bit more stable than Pie.

rpgdev said:
That file is a zip file with two different files in it, do you mean to rename this zip file to engabl.bin?
Click to expand...
Click to collapse
omg no, pick one of the 2 files and rename it to engabl.bin

Blad2301 said:
[ATTACH
Click to expand...
Click to collapse
??????

rpgdev said:
After step 5 I started to get some weird outputs.
Seems like that output is normal because I have the rom rooted and twrped right now but I did have to change the active slot to B at this point because otherwise QFIL wasn't able to read the partitions afterwards. Oddly enough that was the only change I had to make, every other command worked as is referencing abl_a even though I changed the active slot to B (and when I flipped the steps to target slot B instead I just got bootlooped).
Everything's looking good so far. I had not been able to setup twrp on this phone so that's welcome. Hotspot wasn't working on Oreo either so that's another good improvement at least for me. Hopefully, this update ends up being a little bit more stable than Pie.
Click to expand...
Click to collapse
sometime, with both fastboot and qfil/edl.. you need multiple try to get them working

cloud1250000 said:
omg no, pick one of the 2 files and rename it to engabl.bin
Click to expand...
Click to collapse
that's somewhat ambiguous, I ended up putting the abl_a in the a slot and the abl_b in the b slot. Not sure if they're interchangeable or if that's the reason why I experienced the issue I experienced. Shouldn't be but who knows.

I'm noticing that locking the screen takes a while using double tap. At least a second or more before the phone responds and actually locks the screen, is anyone else experiencing this?

rpgdev said:
I'm noticing that locking the screen takes a while using double tap. At least a second or more before the phone responds and actually locks the screen, is anyone else experiencing this?
Click to expand...
Click to collapse
that's odd mine is almost instantly..

cloud1250000 said:
that's odd mine is almost instantly..
Click to expand...
Click to collapse
Apparently it was due to my launcher, they're having some issues with that gesture on Android 10.
The Korean Q is solid, I'm surprised that it's performing better than Pie on this phone. Thanks for doing this guide. Anyways, I still get the camera shutter sound any idea as to why? Also, is there a way to disable the vibration for the fingerprint reader when the read is successful? I managed to do it for Oreo but haven't found a way to do it for Q

rpgdev said:
Apparently it was due to my launcher, they're having some issues with that gesture on Android 10.
The Korean Q is solid, I'm surprised that it's performing better than Pie on this phone. Thanks for doing this guide. Anyways, I still get the camera shutter sound any idea as to why? Also, is there a way to disable the vibration for the fingerprint reader when the read is successful? I managed to do it for Oreo but haven't found a way to do it for Q
Click to expand...
Click to collapse
shutter is muted when I'm on vibration mode

cloud1250000 said:
shutter is muted when I'm on vibration mode
Click to expand...
Click to collapse
Ah, I thought it disabled it on all modes. I didn't get it on vibration. Would be nice to disable it on every mode.

Right the thing with the korean firmware usually is.. it's not disabled even in silent mode lol

cloud1250000 said:
Right the thing with the korean firmware usually is.. it's not disabled even in silent mode lol
Click to expand...
Click to collapse
I see, do you happen to know where is the camera shutter sound now? It used to be \system\media\audio\ui\ but it seems that dir was removed on A10.

cloud1250000 said:
odd! you really shouldn't have to flash that vomaster.zip at all if you're located in the US.. honestly.. I don't even know if rcs is available in canada and I'm really not sure how to test this feature.. You might have to toggle wifi calling again if you got the wifi calling activation success notification.. it was the case on my friend phone..
Just to confirm...
volte/vowifi working?
ulm or awm?
carrier?
Looks like the calendar is available with the open_ca files... not sure for the open_us.. sorry..
Click to expand...
Click to collapse
I don't know how to check for volte working, but vowifi is def working at my work with ****ty at&t signals.
awm -> ulm -> korean q.
I get advanced chat features enabled but nothing works =/ maybe its fixable with googling but im reasonably happy with my phone atm, minus lgpay not being accessible for v35 and v30s outside of korea =\

Has anyone passed safetynet using this rom? Some pointers would be appreciated.

How To Guide How to extract image collection from rom releases (and root the boot image and apply root to the phone)

1. To extract the image collection from your downloaded rom :
Download Payload Dumper from here (It's a zip file but it's not flashable) to your computer
Extract the zip file to a folder, make it a folder you can use regularly because this is the default tool you would use from now on
Download the rom version you want to root
Unzip the rom to a folder, you will find a file within it called payload.bin
Copy and paste that file into the "payload_input" folder within the Payload Dumper folder you created
Execute the payload_dumper.exe file within Payload Dumper folder, you will not have to specify any options as it always extracts from any payload.bin file in payload_input and outputs the image files to payload_output.
Leave the extraction to be completed, the program will automatically close itself once it's completed
Your extracted .img files will be shown within the payload_output folder
2. If you need to root the boot image you extracted :
Copy the boot.img file from the payload_output folder to a folder on your phone storage (Best to name it appropriately if you will be doing this regularly)
Download and Install the latest Magisk apk from the release site (Accept any prompt to allow install from external source)
Launch the app and then choose Install under the top "Magisk" section
Choose Select and Patch a File then browse to where you copied the boot.img on your storage
Magisk will then apply root to the boot image you specified, Your rooted image file will be output to your phone's Download folder : /sdcard/Download
You don't need to keep the default filename of the rooted image file so you can rename it appropriately for the rom version after you copy it to your computer, just ensure to keep the .img file extension
If you rename the rooted boot image, try not to use spaces in the filename, rather use _ or - as spaces make it more difficult to use in a command window although when you start typing the filename you can use TAB to autocomplete it, always ensure the filename shows .img as the extension and at the end of any commandline
3. If you need to use your rooted boot image to apply root to your phone :
Install the drivers from the mounted drive you should get when connecting the phone to your computer
On Windows you should then have a folder in C:\Program Files (x86)\OnePlus USB Drivers\Android with the platform tools (ADB.exe and Fastboot.exe) you will need, you can obviously copy the content from that folder somewhere else if you wish.
Connect your phone to your computer
Copy your rooted boot image to the folder that has adb.exe and fastboot.exe
Open a command window on your computer by right clicking in that folder and choosing Open command window here
In the command window, Type or copy/paste the command ADB devices and press enter
If you see a prompt on your phone to allow the computer connection then accept it, better still, tell it to allow from now on also.
You should see a string of characters shown in the command window, if you don't see that, then try another cable or re-install your drivers and reboot the computer.
Reboot your phone into Fastboot either by using ADB on your computer ( ADB Reboot Fastboot ) or by enabling Advanced reboot in your developer options in settings and then hold down the power button and use the 3 dot menu on the top right and choosing "Bootloader"
In the command window type Fastboot Boot <filename.img> i.e. Fastboot Boot rooted_boot.img and press enter
You should see a couple of lines in the command window telling you it's copying over to the phone, don't worry it's not being flashed or replacing your existing installed boot image
The phone should then restart and boot using the image from your computer, it will be a slightly slower boot than usual, your existing unlock method should still work
Launch the Magisk app, it should already have root access because the boot image you've used is already rooted
Go to Install under the top Magisk section
Choose Direct Install (Recommended)
Magisk will then apply root access to the boot image on the actual phone
You will be prompted to reboot the phone on the bottom right, do this to complete the process
You don't need the phone connected to your computer anymore as the installed boot image on the phone should now have root access
You can check for root either using any app which requires root or by using an app like Root Checker
Remember to empty the contents of payload_input and payload_output once you have finished, leaving them ready for any future rom versions
4. To retain root access after ROM/OTA update :
Install the update either from Oxygen Updater or from Settings > System > System updates
DO NOT REBOOT when prompted
Go to the Magisk app
Go to Install under the top Magisk section
Choose Install to Inactive Slot (After OTA)
Magisk will apply root to the newly installed boot image for the next version
Reboot when prompted by the Magisk app
The phone should reboot into the updated version with root already applied

Very nice write up! Hopefully many will read this and follow instructions. Too many threads being created with issues because they never bother to read.

Quick question as this is my first OnePlus device.
Will I lose root after a system update and will have to it all over again?

Levi4cyber said:
Quick question as this is my first OnePlus device.
Will I lose root after a system update and will have to it all over again?
Click to expand...
Click to collapse
Just added a new section to my original post for this.

Does flashing magisk change anything in encryption?
Does it wipe anything?

How do I get my ROM to extract the boot img?

Levi4cyber said:
Does flashing magisk change anything in encryption?
Does it wipe anything?
Click to expand...
Click to collapse
No and No

Levi4cyber said:
How do I get my ROM to extract the boot img?
Click to expand...
Click to collapse
Read the first post.

djsubterrain said:
Read the first post.
Click to expand...
Click to collapse
I'm asking where to get my ROM file, in order I should be able to extract the boot img?
A link? Somewhere on my phone?

Levi4cyber said:
I'm asking where to get my ROM file, in order I should be able to extract the boot img?
A link? Somewhere on my phone?
Click to expand...
Click to collapse
It's pinned at the top of the entire forum :
[OnePlus 9 Pro][ROM][OTA][Oxygen OS] Repo of Oxygen OS Builds
As OnePlus doesn't always provide download links for all of their OxygenOS ROMs & OTA update zips, we've created an index to put the links in one post so that they're easy to find. Note: This is not a support thread for issues you may have with...
forum.xda-developers.com
They're also posted on OnePlus's site (eventually) :
Software Upgrade - OnePlus.com
Get the latest OxygenOS updates for your device.OxygenOS is always evolving. Learn about the latest features and improvements, and get even more out of your device.
www.oneplus.com
Make sure the version matches the one you're using

I updated to latest version 11.2.4.4.LE15AA
Since there's nowhere to download the OTA package and extract the boot img, can I use the boot img of a lower version - 11.2.2.2 ?

Levi4cyber said:
I updated to latest version 11.2.4.4.LE15AA
Since there's nowhere to download the OTA package and extract the boot img, can I use the boot img of a lower version - 11.2.2.2 ?
Click to expand...
Click to collapse
No, definitely not.
Try Oxygen Updater in advanced mode, it should let you download the full rom.
If you were already rooted though, you should've been able to retain it by following the last section in my original post.
If not, then follow the first 2 sections

djsubterrain said:
No, definitely not.
Try Oxygen Updater in advanced mode, it should let you download the full rom
Click to expand...
Click to collapse
Since I'm completely new to OP, is Oxygen updater an app (if yes, is it this; https://play.google.com/store/apps/details?id=com.arjanvlek.oxygenupdater)? Or is it built into the phone?

Levi4cyber said:
Since I'm completely new to OP, is Oxygen updater an app (if yes, is it this; https://play.google.com/store/apps/details?id=com.arjanvlek.oxygenupdater)? Or is it built into the phone?
Click to expand...
Click to collapse
I've linked it, it's not a default app

djsubterrain said:
No, definitely not.
Try Oxygen Updater in advanced mode, it should let you download the full rom.
If you were already rooted though, you should've been able to retain it by following the last section in my original post.
If not, then follow the first 2 sections
Click to expand...
Click to collapse
In the oxygen updater app, if I select "full update" in update method it only gives me version 11.2.2.2., if I select "incremental update", it lets me download 11.2.4.4, and when I unzipped it I have a file payload.bin (it's only 105MB).
Should I use that? Or do I need a full OTA package to extract the boot IMG?

Levi4cyber said:
In the oxygen updater app, if I select "full update" in update method it only gives me version 11.2.2.2., if I select "incremental update", it lets me download 11.2.4.4, and when I unzipped it I have a file payload.bin (it's only 105MB).
Should I use that? Or do I need a full OTA package to extract the boot IMG?
Click to expand...
Click to collapse
Are you choosing the correct OnePlus 9 Pro? It'll show you different variants under the model lookup.
To be honest, If I get the update pushed via OnePlus I always copy/paste it somewhere else cos I think it gets deleted once the upgrade is done.
If you extract the payload.bin and it shows a boot.img then that should suffice. I think it should be around 105MB (I'm on my work PC at the moment so can't check)

Thanks. I'm on the T-Mobile version of the OnePlus 9 Pro, technically my phone is currently on "11.2.2.2.LE5ACB" and the one on OnePlus's support site is "11.2.2.2.LE15AA". I'm not sure the difference but I assume T-Mobile bloatware. Hopefully they didn't do anything else to make the phone work "slightly better" on their network.
I'm not sure if the boot.img I extracted from 11.2.2.2.LE15AA will work with my currently-installed "11.2.2.2.LE5ACB"; any ideas?
Might be better to create a boot.img from my existing version and patch that. Do you know the dd command for me to just create the boot.img from my existing partition? In the past with other phones I've done something like "dd if=/dev/block/mmcblk0 of=/storage/sdcard1/boot.img bs=4096 count=4096 skip=7552" or "dd if=/dev/block/bootdevice/by-name/boot of=boot.img" but I don't know which partition on the OnePlus 9 Pro to image. Any ideas?
--- Update 1 ---
Code:
OnePlus9ProTMO:/ $ ls -l /dev/block/bootdevice/by-name/*boot*
lrwxrwxrwx 1 root root 16 1970-01-20 02:38 /dev/block/bootdevice/by-name/boot_a -> /dev/block/sde16
lrwxrwxrwx 1 root root 16 1970-01-20 02:38 /dev/block/bootdevice/by-name/boot_b -> /dev/block/sde43
lrwxrwxrwx 1 root root 16 1970-01-20 02:38 /dev/block/bootdevice/by-name/vendor_boot_a -> /dev/block/sde28
lrwxrwxrwx 1 root root 16 1970-01-20 02:38 /dev/block/bootdevice/by-name/vendor_boot_b -> /dev/block/sde55
lrwxrwxrwx 1 root root 16 1970-01-20 02:38 /dev/block/bootdevice/by-name/vm-bootsys_a -> /dev/block/sde24
lrwxrwxrwx 1 root root 16 1970-01-20 02:38 /dev/block/bootdevice/by-name/vm-bootsys_b -> /dev/block/sde51
Then looking at my active mounts I saw this:
Code:
OnePlus9ProTMO:/ $ mount | egrep "sde16|sde43|sde28|sde55|sde24|sde51"
/dev/block/sde51 on /vendor/vm-system type ext4 (ro,seclabel,nosuid,nodev,relatime)
Which indicates that I'm on the "b" side. So I would want to create a boot.img from `/dev/block/bootdevice/by-name/vendor_boot_b` potentially. So this command "should" work, right?
Code:
dd if=/dev/block/bootdevice/by-name/vendor_boot_b of=/sdcard/Download/stock_boot.img
I might try that instead of the boot.img I extracted from 11.2.2.2.LE5ACB since it doesn't technically line up with the T-Mobile supplied ROM version.
--- Update 2 ---
Yeah, that didn't work.Turns out dd needs to be elevated to do its thing. Got a "Permission denied" when i tried to create the image. So yeah, ironically I need root to run said command and that's why I was trying to run the command, to get the boot.img to root. lol. oh well.

Thank you very detailed.

When I click on the payload_pumper.exe file, the cmd window flashes and nothing else happens.

glitchsys said:
Turns out dd needs to be elevated to do its thing.
Click to expand...
Click to collapse
Try watching this, man, I think this is exactly what you are missing:
Code:
https://www.youtube.com/watch?v=DyUainEJwLM