Modify system.img on Marshmallow ROM locked BL to gain adblock, edit build.prop etc - G4 General

Hi
I wonder why no one is doing mods as the Sprint G4's forums are doing http://forum.xda-developers.com/spr...-mellowmallow-debloated-60fps-camera-t3341993
Take a look at this, they are using Send_Command exploit, as used in Lolipop to gain root. Many of you after MM update thought the LG blocked this metod but actually we can use it again. Just start flashing any .kdz by LG UP and at 9% at computer, and when green COMx shows on screen just unplug USB.
After that run Send_Command and you are root. We can dump system.img, modify it in any way and using dd command, flash it back to phone.
I am 100% sure this will work.
We can't gain ROOT on Marshmallow this way but we can de-bloat and put modifications or even themed/modified stock LG apps.

JoHnNy08PL said:
Hi
I wonder why no one is doing mods as the Sprint G4's forums are doing http://forum.xda-developers.com/spr...-mellowmallow-debloated-60fps-camera-t3341993
Take a look at this, they are using Send_Command exploit, as used in Lolipop to gain root. Many of you after MM update thought the LG blocked this metod but actually we can use it again. Just start flashing any .kdz by LG UP and at 9% at computer, and when green COMx shows on screen just unplug USB.
After that run Send_Command and you are root. We can dump system.img, modify it in any way and using dd command, flash it back to phone.
I am 100% sure this will work.
We can't gain ROOT on Marshmallow this way but we can de-bloat and put modifications or even themed/modified stock LG apps.
Click to expand...
Click to collapse
This is nice. Problem is, will someone use this to do some modifications for our MM?

https://plus.google.com/108809553303056950825/posts/3tkNdkaMnNK

the_naxhoo said:
https://plus.google.com/108809553303056950825/posts/3tkNdkaMnNK
Click to expand...
Click to collapse
This is for H815P only, anything for H818?

MitoTakatori said:
This is for H815P only, anything for H818?
Click to expand...
Click to collapse
It's for both (H815 & H818). Check again.

Last night I actually modified my system.img
I have right now 530DPI, all apps in Dual Window and louder headphone output.
Edits were made to /system/build.prop and /system/etc/mixer_profiles.xml
Everything is working great so far.

Now keep in mind if u pull the plug to late you risk hard bricking. There have been cases reported. And this is a dangerous method but it does work

You can check out my github repo for examples.
https://github.com/tabp0le/MellowMallowROM-for-G4-LS991
I've debloated and modified/replaced these files:
https://github.com/tabp0le/MellowMallowROM-for-G4-LS991/blob/master/system/build.prop
https://github.com/tabp0le/MellowMallowROM-for-G4-LS991/blob/master/system/etc/hosts
https://github.com/tabp0le/MellowMallowROM-for-G4-LS991/blob/master/system/etc/fonts.xml
https://github.com/tabp0le/MellowMallowROM-for-G4-LS991/blob/master/system/etc/fallback_fonts.xml
https://github.com/tabp0le/MellowMa...blob/master/system/etc/init.qcom.post_boot.sh (this has some sprint specific modifications)
https://github.com/tabp0le/MellowMallowROM-for-G4-LS991/blob/master/system/etc/camera_config.xml
https://github.com/tabp0le/MellowMallowROM-for-G4-LS991/blob/master/system/etc/media_profiles.xml
https://github.com/tabp0le/MellowMallowROM-for-G4-LS991/blob/master/system/etc/mixer_paths.xml
https://github.com/tabp0le/MellowMallowROM-for-G4-LS991/blob/master/system/fonts/NotoColorEmoji.ttf
https://github.com/tabp0le/MellowMa.../system/app/LatinImeGoogle/LatinImeGoogle.apk

not worth it, too risky to end up with bricked phone,,

the_naxhoo said:
It's for both (H815 & H818). Check again.
Click to expand...
Click to collapse
Translated it:
Good evening, folks. As promised, I bring you the system.img modified by me the rom marshmallow br with the changes in build.prop. . Follow strictly all the steps and pay close attention Files Needed: • LG system.img modified modified H818P: https://drive.google.com/open?id=0B-qopUSJ7Y5KWUR4Z3FMXzR5VTQ • Drivers LG Root (to pass the ROM via -. Enable USB debugging and oem unlock the developer options Copy system.img downloaded to the root folder of your lg g4 shut off the phone with the same plug off the USB cable by pressing the volume button +, the. phone will go into download mode. 2 - Pay close attention:. Now on your computer, open the LG UP and select a rOM (any KDZ) and start the installation process When you reach the 9% on your computer and mobile display the number of uSB port in green (eg COM3), unplug the qUICKLY cable This process is necessary because the LG blocked common access the COM port in Marshmallow.. 3 - Close the LG UP, and enter the LG_ROOT folder and open the file "PORTS", will open another command window, copy the port number that appears in the "\ Device \ LGANDNETDIAG1 REG_SZ COM5 *" (Using the example COM5). 4 - Go to the folder where is located the LG ROOT, press shift, click the right button and click Open command window here Type:. ". Send_Command.exe \\ \ COM5" (COM5 is the sample number, place the number of your door that took in the previous step and press enter .) 5 - will appear on one line with "#" Enter "id" (without quotes) and you will see a line like this: "uid = (0) root gid = (0) root" if aperecer FAIL retrace all . process 6 - Copy and paste the following command in CMD: dd if = / data / media / 0 / system.img bs = 8192 count = seek = 55 296 529 920 of = / dev / block / mmcblk0 After about 2.3 minutes appears the old game symbol again. Then type LEAVE. If the phone does not restart alone, unplug the cable, remove your battery, place and turn on. After starting, the unit will already be with low DPI and the double window enabled for all apps. Recommend to perform a factory reset before using the ROM. Attention: Only for H815P. Do not take responsibility for any damage to your phone. Remarks: - I'm studying the possibility of injecting the Xposed directly on img, and perform some more general settings, such as adding the native v10 apps on it (apps manager, weather, camera, etc.) and try to implement the viper4android. But as I walk out of time due to studies, I believe that in the offseason can take time to make the changes and go testing to be able to provide.
---------------------
The bold one says it's for H815P only?
---------- Post added at 11:03 ---------- Previous post was at 11:03 ----------
JoHnNy08PL said:
Last night I actually modified my system.img
I have right now 530DPI, all apps in Dual Window and louder headphone output.
Edits were made to /system/build.prop and /system/etc/mixer_profiles.xml
Everything is working great so far.
Click to expand...
Click to collapse
Is this for H818P? MM?

MitoTakatori said:
Translated it:
Good evening, folks. As promised, I bring you the system.img modified by me the rom marshmallow br with the changes in build.prop. . Follow strictly all the steps and pay close attention Files Needed: • LG system.img modified modified H818P: https://drive.google.com/open?id=0B-qopUSJ7Y5KWUR4Z3FMXzR5VTQ • Drivers LG Root (to pass the ROM via -. Enable USB debugging and oem unlock the developer options Copy system.img downloaded to the root folder of your lg g4 shut off the phone with the same plug off the USB cable by pressing the volume button +, the. phone will go into download mode. 2 - Pay close attention:. Now on your computer, open the LG UP and select a rOM (any KDZ) and start the installation process When you reach the 9% on your computer and mobile display the number of uSB port in green (eg COM3), unplug the qUICKLY cable This process is necessary because the LG blocked common access the COM port in Marshmallow.. 3 - Close the LG UP, and enter the LG_ROOT folder and open the file "PORTS", will open another command window, copy the port number that appears in the "\ Device \ LGANDNETDIAG1 REG_SZ COM5 *" (Using the example COM5). 4 - Go to the folder where is located the LG ROOT, press shift, click the right button and click Open command window here Type:. ". Send_Command.exe \\ \ COM5" (COM5 is the sample number, place the number of your door that took in the previous step and press enter .) 5 - will appear on one line with "#" Enter "id" (without quotes) and you will see a line like this: "uid = (0) root gid = (0) root" if aperecer FAIL retrace all . process 6 - Copy and paste the following command in CMD: dd if = / data / media / 0 / system.img bs = 8192 count = seek = 55 296 529 920 of = / dev / block / mmcblk0 After about 2.3 minutes appears the old game symbol again. Then type LEAVE. If the phone does not restart alone, unplug the cable, remove your battery, place and turn on. After starting, the unit will already be with low DPI and the double window enabled for all apps. Recommend to perform a factory reset before using the ROM. Attention: Only for H815P. Do not take responsibility for any damage to your phone. Remarks: - I'm studying the possibility of injecting the Xposed directly on img, and perform some more general settings, such as adding the native v10 apps on it (apps manager, weather, camera, etc.) and try to implement the viper4android. But as I walk out of time due to studies, I believe that in the offseason can take time to make the changes and go testing to be able to provide.
---------------------
The bold one says it's for H815P only?
---------- Post added at 11:03 ---------- Previous post was at 11:03 ----------
Is this for H818P? MM?
Click to expand...
Click to collapse
h818 xD

the_naxhoo said:
h818 xD
Click to expand...
Click to collapse
Haha. Sorry. My bad mate. Thank you for this! :good:
---------- Post added at 13:15 ---------- Previous post was at 13:07 ----------
Anyone tried this?

The commands are the same for H815P, H818P and international H815. You can use this translated page to do it yourself but be aware - google translate messed up commands so go copy them from source, not this translated text.

Out of curiosity, would it be possible to add root to this?

No, you can't root Marshmallow without modyfing kernel (boot.img) and you can't do this because you have locked bootloader.

On what firmware this thing is based? 20a? 20c?

Related

[BUSYBOX]Busybox Installation

Don't Use.
That's awesome! Thanks for this. What about xposed? I guess since this flashes blocks 1, 5, 16 there isn't a way to add it before or after.
Sent from my locked but not stocked XT1080.
chuck864 said:
That's awesome! Thanks for this. What about xposed? I guess since this flashes blocks 1, 5, 16 there isn't a way to add it before or after.
Sent from my locked but not stocked XT1080.
Click to expand...
Click to collapse
If I remember correctly, this includes Xposed.
Sent from my Nexus 6 using Tapatalk
Yeah, you said it originally but it wasn't listed in your last post. Maybe add what all is included at the top of the OP for any new comers.
Sent from my locked but not stocked XT1080.
chuck864 said:
Yeah, you said it originally but it wasn't listed in your last post. Maybe add what all is included at the top of the OP for any new comers.
Sent from my locked but not stocked XT1080.
Click to expand...
Click to collapse
Gotcha, added to OP.
Sent from my Nexus 6 using Tapatalk
after flashed. I can install safestrap then flash custom rom??
Quick question. In the starting of the guide , it says
Warning : It wipes off all data.
Then in step 5, you talk about modified XML which helps you to keep data. So is it safe to assume that data is preserved during flash ?
Edit : NVM, Saw your note in the middle of the post. My Bad.
BTW, thanks OP for providing debloated ROM and Viper4android . Finally the perfect ROM *_*
Tuulaihuu said:
after flashed. I can install safestrap then flash custom rom??
Click to expand...
Click to collapse
I feel sorry for OP and the other users here who have said a countless number of times that this ain't possible as of now due to write protect = 1 :3
I think many people tried to download this, dropbox says:
Error (429)
This account's public links are generating too much traffic and have been temporarily disabled!
can someone upload a copy to for example google-drive?
pizmak said:
I think many people tried to download this, dropbox says:
Error (429)
This account's public links are generating too much traffic and have been temporarily disabled!
can someone upload a copy to for example google-drive?
Click to expand...
Click to collapse
I will, one second.
Edit: Updated.
Sent from my Nexus 6 using Tapatalk
Question
If my phone is already rooted, do I still have to start from scratch?
And, how much time should this take?
I read somewhere it was 16 hours?
hazam1992 said:
If my phone is already rooted, do I still have to start from scratch?
And, how much time should this take?
I read somewhere it was 16 hours?
Click to expand...
Click to collapse
Yes and yes.
Sent from my locked but not stocked XT1080.
thenameisnigel said:
If I remember correctly, this includes Xposed.
Sent from my Nexus 6 using Tapatalk
Click to expand...
Click to collapse
Just double checking, when i reflash this my phone will automatically have xposed, busybox, & viper4android after following the directions, and where it says get busybox RIGHT HERE there isn't a link, that is the reason i'm just getting my facts straight. my phone is almost at 100% and i wanna do this right. Thank you sooooooo much crash and @thenameisnigel for all of the work put into this.
jblock92 said:
Just double checking, when i reflash this my phone will automatically have xposed, busybox, & viper4android after following the directions, and where it says get busybox RIGHT HERE there isn't a link, that is the reason i'm just getting my facts straight. my phone is almost at 100% and i wanna do this right. Thank you sooooooo much @CrashXXL and @thenameisnigel for all of the work put into this.
Click to expand...
Click to collapse
Link fixed and yes, everything will work after it's reflashed.
thenameisnigel said:
Link fixed and yes, everything will work after it's reflashed.
Click to expand...
Click to collapse
ok and sorry but 2 more things, are the edited xml files included in the (the firmware here) link because i didnt see a link there for it ( i'm still downloading off wifi so i cant check), and other is the busy box comes up on my pc as "busybox-armv7l" and its file type is file, so before i move it i'm to rename it as plain "busybox" and do i have to alter the file extension or leave it as is? sorry I haven't done any of this stuff since rooting the droid bionic so i'm a little rusty
and all of the extra batch files for example Runsys_1-5 will auto run in the process?
---------- Post added at 10:44 PM ---------- Previous post was at 10:15 PM ----------
jblock92 said:
ok and sorry but 2 more things, are the edited xml files included in the (the firmware here) link because i didnt see a link there for it ( i'm still downloading off wifi so i cant check), and other is the busy box comes up on my pc as "busybox-armv7l" and its file type is file, so before i move it i'm to rename it as plain "busybox" and do i have to alter the file extension or leave it as is? sorry I haven't done any of this stuff since rooting the droid bionic so i'm a little rusty
and all of the extra batch files for example Runsys_1-5 will auto run in the process?
Click to expand...
Click to collapse
i guess what i mean is the stuff added through you such as the added batch files and the sys folder gonna automatically do its thing when i reflash?
---------- Post added at 11:35 PM ---------- Previous post was at 10:44 PM ----------
please help my loose cord accidently unplugged during flashing system.img 7/16 in rsd and keep getting fail now
nvm restarting rsd seemed to fix
jblock92 said:
and all of the extra batch files for example Runsys_1-5 will auto run in the process?
i guess what i mean is the stuff added through you such as the added batch files and the sys folder gonna automatically do its thing when i reflash?
Click to expand...
Click to collapse
Yeah, I have looked around and can't find what .bat file to run. The RUN_SYS1,2,3,4,5 look like they would be it but I'm not sure if you run just the first or all of them. I am downloading the files now and will look into it more once it completes. The guide is confusing because it's just a quickly patched version of somberfox's. I will see if I can clean it up once I have all the details.
EDIT: Looks like you have to run every RUN_SYS.bat file in order. They are broke up so you can charge your phone in between each one I believe. YOU DO NOT want your battery to die will doing this.
** UPDATED ** I take no credit or responsibility for this. Please do what ever you want with it.
** YOU NEED ROOT ACCESS FOR THIS. IF YOU DO NOT HAVE IT THEN FOLLOW THE GUIDE HERE
Instructions
This entire method is the work of user @CrashXXL and Busybox/V4A/Debloated/Xposed installation by @thenameisnigel. This is a literal copy and paste of @somberfox 's awesome guide with just busybox instructions (Thank you, you're the best for the guide as I'm terrible at rightups). I am ONLY writing it up like this to make the instructions as plain as possible for anyone to follow. All credit goes to @CrashXXL for this awesome hack. Normal warnings, it isn’t my fault, and it isn’t crashxxl’s fault if your phone gets ****ed up because you messed up the process or didn’t read things through carefully. This is an AT YOUR OWN RISK situation. If you can’t afford to lose your phone, don’t do this.
******* WARNING *******
MAKE SURE YOU HAVE A FACTORY CABLE THAT WILL CHARGE YOUR PHONE WHILE IN FASTBOOT. DO THIS BY BOOTING INTO FASTBOOT WITH YOUR PHONE PLUGGED INTO THE CHARGER AND SEE IF IT SAYS THE BATTERY IS CHARGING. IF YOU CAN NOT CHARGE YOUR PHONE IN FASTBOOT THEN YOU CAN NOT DO THIS METOD.
******* END WARNING *******
WHAT THIS ACHIEVES: This will give your phone Root/Busybox/V4A/Debloated/Xposed but WILL NOT turn off /system write protection.
WARNING: THIS WIPES ALL DATA ON YOUR PHONE. Backup any pictures or files you have stored there that you want to keep. UPDATE: YOU CAN KEEP ALL DATA WITH THE XML FILE LINKED IN THE FILES SECTION, but I would still recommend backing things up. Seriously, it's your data. Back it up.
This method works on the following phones:
-Droid Mini XT1030 SU6-7
-Droid MAXX XT1080m SU6-7
-Droid Ultra XT1080 SU6-7
NEEDED FILES
RSD Lite
Motorola Drivers – (if you don’t have these, or know if you have them, get them)
This firmware, CFC-obakem_verizon-user-4.4.4-SU6-7-release-keys.xml.zip
The Soft_and_Drivers.rar file from here
Download Python27.zip from here.
Edited XML file to maintain data in reflash. Thank you user @chuck864 for providing this!
THE PROCESS (Do yourself a favor, start with a fully charged phone)
1.)Install RSD Lite
2.)Install Motorola Drivers
3.)Open the Soft_and_Drivers.zip and extract the files. Install Python 2.7.9 first, and then install pyserial 2.7. This should create a Python27 folder on your C: drive (or other base computer drive). This will be our working folder. Extract the windows_drivers_QHSUSB_DLOAD.zip to the Python27 folder for safe keeping. You might not need this.
4.)Extract everything in the Python27.zip you downloaded to your desktop and copy the contents of the python27 folder you just extracted to the Python27 folder on your C: drive. Overwrite everything.
5.)Create a folder in Python27 called “444” and extract the CFC-obakem_verizon-user-4.4.4-SU6-7-release-keys.xml.zip to that folder. IF YOU WISH TO SAVE THE DATA ON YOUR PHONE, now extract the Edited XML file you downloaded above and copy it into your 444 folder and replace the old version of the file. This one has been edited to allow you to keep your data during the next step.
5.1) DO NOT FORGET THIS STEP.
On your phone, go to a shell and run
Code:
su
cp -R /system/xbin /data/xbin
THIS IS IMPORTANT.
6.) Power down your phone entirely and boot into FASTBOOT. You do this by holding down the POWER and the VOLUME DOWN button at the same time for ten seconds. When you release them you'll be in FASTBOOT. Now plug your phone into your computer (NOT INTO A USB 3.0 PORT, those are off limits for this whole install), and run RSD Lite. Click the “…” next to the blank space that says “filename” and navigate to the “444” folder you just extracted. Select the XML file and click “ok”. Now click “Start” and wait for the process to run and for your phone to reboot. IF THIS PROCESS FAILS and you get something that says “failed flashing process, unknown fastboot command,” then you need to go into the XML file in your “444” folder and delete the line . Then start STEP 6 over again and it should work this time.
7.)After the reboot, boot your phone into FASTBOOT. This is done by powering down your phone all the way (make sure you are not plugged into your USB cable) and then press and hold the POWER and VOLUME DOWN (at least on the Maxx) button on your phone at the same time. Hold this for about ten seconds and then let go. You’ll be in fastboot.
8.)Run BLBROKE.bat from your Python27 folder. This will run a script that is essentially bricking your phone. Your screen will go black. Leave it alone for a minute or two, and then open up your “Devices and Printers” control panel frame and see if you have something listed called qualcomm hs-usb qdloader 9008. If you do, go to STEP 9. If you do not, try unplugging your phone from your computer, and then plugging it back in. Wait for it to be recognized. If you STILL don’t have qualcomm hs-usb qdloader 9008 listed under Devices and Printers, go to device manager and look for it RIGHT HERE.
It will probably be listed as “Unknown Device”. If this is the case, open up the “Unknown Device” and click “Update Driver” and then “Browse Computer.” Remember the windows_drivers_QHSUSB_DLOAD.zip you extracted in STEP 3? Navigate to that folder and tell it to look for the drivers there. It will find them. Install, and you’re good to go! You may need to unplug your phone and plug it back in, but you might not.
IF YOU CANNOT GET THE DRIVER TO INSTALL, it is probably because you need to allow the running of unsigned drivers. Do a google search for "allow unsigned drivers" and your version of windows. This tutorial is long enough without adding that process to it.
******* FINAL WARNING ********
THIS IS NOT FOR THE FAINT OF HEART OR ANYONE WHO DOESN"T WANT TO THROW THEIR PHONE IN THE TRASH!
SCARED YET??? YOU WILL BE. YOU WILL BE.
YOU CAN SIMPLY RUN RUN_SBL.bat IN YOUR PYTHON27 FOLDER AND YOUR PHONE WILL REBOOT NORMALY.
I HAVE NOT DONE THIS AND AM ONLY REPOSTING THE DIRECTIONS I HAVE READ SO YOU ARE ON YOUR OWN.
THIS IS YOUR LAST CHANCE TO RUN TO SAFTEY AND ENJOY WHAT EVER IS LEFT OF YOUR DAY!
********* END OF FINAL WARNING ********
STILL HERE?
9.)This process will take 10+ hours.
Run RUN_SYS1.bat, This will flash (1-30) parts of system section
After it completes, the phone will try to start and will hang on the logo, boot into fastboot. Let the battery charge for 15-20 minutes and then run BLBROKE.bat from your Python27 folder again.
Run RUN_SYS2.bat,This will flash 30 (31-60) Parts of partition system.
After it completes, the phone will try to start and will hang on the logo, boot into fastboot. Let the battery charge for 15-20 minutes and then run BLBROKE.bat from your Python27 folder again.
Run RUN_SYS3.bat,This will flash 30 (61-90) Parts of partition system.
After it completes, the phone will try to start and will hang on the logo, boot into fastboot. Let the battery charge for 15-20 minutes and then run BLBROKE.bat from your Python27 folder again.
Run RUN_SYS4.bat,This will flash 30 (90-120) Parts of partition system.
After it completes, the phone will try to start and will hang on the logo, boot into fastboot. Let the battery charge for 15-20 minutes and then run BLBROKE.bat from your Python27 folder again.
Run RUN_SYS5.bat,This will flash 30 (121-132) Parts of partition system.
When it’s done, your phone should reboot and start up normally.
After the phone boots, run the following steps to install busybox.
1. Download busybox-armv7l from RIGHT HERE.
2. Use a root file explorer to copy busybox-armv7l to your /data/xbin folder and rename it busybox
3. Open terminal and type busybox --install /data/xbin
4. Reboot your phone.
You should now have root, xposed, busybox, and debloat if all went well.
Go and get a beer for a job well done! :highfive:
FAQ
q. Will sunshine work?
a. No, sunshine will not work after this method.
q. Can I install and use (insert an app name here)?
a. Any root app can be installed and used, BUT if the app takes access to /system to work then you will have to bake-in the app and reflash your phone to get it working. It’s not a simple process.
q. How do I get into FASTBOOT?
a. Well, if you didn't read Step 7 where it tells you how to do this already, here is how this is done (again): Power the device off completely and make sure it's not plugged in. Now hold down the POWER and VOLUME DOWN button for about ten seconds and then let them go. This will get you into fastboot.
q. Hey, none of the changes I made to system/ stuck after I rebooted my phone. What gives?!
a. NO CHANGES TO SYSTEM/ WILL PERSIST AFTER A HARD REBOOT. NONE EXCEPT BUSYBOX UPGRADES.
Also, if you love this Root setup as much as I do, PLEASE consider donating to CrashXXL! He has done great work on this and donations help keep folks like him working on innovations for us.
chuck864 said:
Please do what ever you want with it.
Click to expand...
Click to collapse
Sorry, I'm real lazy and don't not speak windows hardly at all.
Say I have one of those cool chargey factory cords and I wanna use linux to do all this, is there any reason I couldn't just plug the phone in with that cord, use a bash script something like this:
Code:
#!/usr/bin/bash
python qdloadSYS1.py MPRG8960.bin -ptf _SYS/partitions.txt
python qdloadSYS2.py MPRG8960.bin -ptf _SYS/partitions.txt
python qdloadSYS3.py MPRG8960.bin -ptf _SYS/partitions.txt
python qdloadSYS4.py MPRG8960.bin -ptf _SYS/partitions.txt
python qdloadSYS5.py MPRG8960.bin -ptf _SYS/partitions.txt
and go wash dishes (I am real lazy and ain't not done them in awhile)?
I see some notes on flashing blbroke in betwixt each step is why I ask. Not that I really want to wash dishes er nuthin'. It doesn't fix the bootloader at each step does it? If so, is there some re-write on the qdload that could allow the whole shebang in one step? Given I have one of those factory cords (and a short attention span)?
Again, this hinges on having a factory cord that allows you to disregard the state of the battery.
chuck864 said:
** UPDATED ** I take no credit or responsibility for this. Please do what ever you want with it.
Instructions
This entire method is the work of user @CrashXXL and Busybox/V4A/Debloated/Xposed installation by @thenameisnigel. This is a literal copy and paste of @somberfox 's awesome guide with just busybox instructions (Thank you, you're the best for the guide as I'm terrible at rightups). I am ONLY writing it up like this to make the instructions as plain as possible for anyone to follow. All credit goes to @CrashXXL for this awesome hack. Normal warnings, it isn’t my fault, and it isn’t crashxxl’s fault if your phone gets ****ed up because you messed up the process or didn’t read things through carefully. This is an AT YOUR OWN RISK situation. If you can’t afford to lose your phone, don’t do this.
******* WARNING *******
MAKE SURE YOU HAVE A FACTORY CABLE THAT WILL CHARGE YOUR PHONE WHILE IN FASTBOOT. DO THIS BY BOOTING INTO FASTBOOT WITH YOUR PHONE PLUGGED INTO THE CHARGER AND SEE IF IT SAYS THE BATTERY IS CHARGING. IF YOU CAN NOT CHARGE YOUR PHONE IN FASTBOOT THEN YOU CAN NOT DO THIS METOD.
******* END WARNING *******
WHAT THIS ACHIEVES: This will give your phone Root/Busybox/V4A/Debloated/Xposed but WILL NOT turn off /system write protection.
WARNING: THIS WIPES ALL DATA ON YOUR PHONE. Backup any pictures or files you have stored there that you want to keep. UPDATE: YOU CAN KEEP ALL DATA WITH THE XML FILE LINKED IN THE FILES SECTION, but I would still recommend backing things up. Seriously, it's your data. Back it up.
This method works on the following phones:
- Droid Mini XT1030 SU6-7
- Droid MAXX XT1080m SU6-7
- Droid Ultra XT1080 SU6-7
If you are already rooted using crashxxl's method and are running 6-7 then read below. If not, then skip to "NEEDED FILES".
*********************************************************************************
* Section For people who have already rooted using Crashxxl's method running 6-7.
* Download this file. Here.
* Only do steps 4, 5.1, 9
*********************************************************************************
NEEDED FILES
RSD Lite
Motorola Drivers – (if you don’t have these, or know if you have them, get them)
This firmware, CFC-obakem_verizon-user-4.4.4-SU6-7-release-keys.xml.zip
The Soft_and_Drivers.rar file from here
Download Python27.zip from here.
Edited XML file to maintain data in reflash. Thank you user @chuck864 for providing this!
THE PROCESS (Do yourself a favor, start with a fully charged phone)
1.)Install RSD Lite
2.)Install Motorola Drivers
3.)Open the Soft_and_Drivers.zip and extract the files. Install Python 2.7.9 first, and then install pyserial 2.7. This should create a Python27 folder on your C: drive (or other base computer drive). This will be our working folder. Extract the windows_drivers_QHSUSB_DLOAD.zip to the Python27 folder for safe keeping. You might not need this.
4.)Extract everything in the Python27.zip you downloaded to your desktop and copy the contents of the python27 folder you just extracted to the Python27 folder on your C: drive. Overwrite everything.
5.)Create a folder in Python27 called “444” and extract the CFC-obakem_verizon-user-4.4.4-SU6-7-release-keys.xml.zip to that folder. IF YOU WISH TO SAVE THE DATA ON YOUR PHONE, now extract the Edited XML file you downloaded above and copy it into your 444 folder and replace the old version of the file. This one has been edited to allow you to keep your data during the next step.
5.1) DO NOT FORGET THIS STEP.
On your phone, go to a shell and run
Code:
cp -R /system/xbin /data/xbin
THIS IS IMPORTANT.
6.) Power down your phone entirely and boot into FASTBOOT. You do this by holding down the POWER and the VOLUME DOWN button at the same time for ten seconds. When you release them you'll be in FASTBOOT. Now plug your phone into your computer (NOT INTO A USB 3.0 PORT, those are off limits for this whole install), and run RSD Lite. Click the “…” next to the blank space that says “filename” and navigate to the “444” folder you just extracted. Select the XML file and click “ok”. Now click “Start” and wait for the process to run and for your phone to reboot. IF THIS PROCESS FAILS and you get something that says “failed flashing process, unknown fastboot command,” then you need to go into the XML file in your “444” folder and delete the line . Then start STEP 6 over again and it should work this time.
7.)After the reboot, boot your phone into FASTBOOT. This is done by powering down your phone all the way (make sure you are not plugged into your USB cable) and then press and hold the POWER and VOLUME DOWN (at least on the Maxx) button on your phone at the same time. Hold this for about ten seconds and then let go. You’ll be in fastboot.
8.)Run BLBROKE.bat from your Python27 folder. This will run a script that is essentially bricking your phone. Your screen will go black. Leave it alone for a minute or two, and then open up your “Devices and Printers” control panel frame and see if you have something listed called qualcomm hs-usb qdloader 9008. If you do, go to STEP 9. If you do not, try unplugging your phone from your computer, and then plugging it back in. Wait for it to be recognized. If you STILL don’t have qualcomm hs-usb qdloader 9008 listed under Devices and Printers, go to device manager and look for it RIGHT HERE.
It will probably be listed as “Unknown Device”. If this is the case, open up the “Unknown Device” and click “Update Driver” and then “Browse Computer.” Remember the windows_drivers_QHSUSB_DLOAD.zip you extracted in STEP 3? Navigate to that folder and tell it to look for the drivers there. It will find them. Install, and you’re good to go! You may need to unplug your phone and plug it back in, but you might not.
IF YOU CANNOT GET THE DRIVER TO INSTALL, it is probably because you need to allow the running of unsigned drivers. Do a google search for "allow unsigned drivers" and your version of windows. This tutorial is long enough without adding that process to it.
******* FINAL WARNING ********
THIS IS NOT FOR THE FAINT OF HEART OR ANYONE WHO DOESN"T WANT TO THROW THEIR PHONE IN THE TRASH!
SCARED YET??? YOU WILL BE. YOU WILL BE.
YOU CAN SIMPLY RUN RUN_SBL.bat IN YOUR PYTHON27 FOLDER AND YOUR PHONE WILL REBOOT NORMALY.
I HAVE NOT DONE THIS AND AM ONLY REPOSTING THE DIRECTIONS I HAVE READ SO YOU ARE ON YOUR OWN.
THIS IS YOUR LAST CHANCE TO RUN TO SAFTEY AND ENJOY WHAT EVER IS LEFT OF YOUR DAY!
********* END OF FINAL WARNING ********
STILL HERE?
9.)This process will take 10+ hours.
Run RUN_SYS1.bat, This will flash (1-30) parts of system section
After it completes, the phone will try to start and will hang on the logo, boot into fastboot. Let the battery charge for 15-20 minutes and then run BLBROKE.bat from your Python27 folder again.
Run RUN_SYS2.bat,This will flash 30 (31-60) Parts of partition system.
After it completes, the phone will try to start and will hang on the logo, boot into fastboot. Let the battery charge for 15-20 minutes and then run BLBROKE.bat from your Python27 folder again.
Run RUN_SYS3.bat,This will flash 30 (61-90) Parts of partition system.
After it completes, the phone will try to start and will hang on the logo, boot into fastboot. Let the battery charge for 15-20 minutes and then run BLBROKE.bat from your Python27 folder again.
Run RUN_SYS4.bat,This will flash 30 (90-120) Parts of partition system.
After it completes, the phone will try to start and will hang on the logo, boot into fastboot. Let the battery charge for 15-20 minutes and then run BLBROKE.bat from your Python27 folder again.
Run RUN_SYS5.bat,This will flash 30 (121-132) Parts of partition system.
When it’s done, your phone will reboot and you will have root, busybox, etc.
Go and get a beer for a job well done! :highfive:
FAQ
q. Will sunshine work?
a. No, sunshine will not work after this method.
q. Can I install and use (insert an app name here)?
a. Any root app can be installed and used, BUT if the app takes access to /system to work then you will have to bake-in the app and reflash your phone to get it working. It’s not a simple process.
q. How do I get into FASTBOOT?
a. Well, if you didn't read Step 7 where it tells you how to do this already, here is how this is done (again): Power the device off completely and make sure it's not plugged in. Now hold down the POWER and VOLUME DOWN button for about ten seconds and then let them go. This will get you into fastboot.
q. Hey, none of the changes I made to system/ stuck after I rebooted my phone. What gives?!
a. NO CHANGES TO SYSTEM/ WILL PERSIST AFTER A HARD REBOOT. NONE EXCEPT BUSYBOX UPGRADES.
Also, if you love this Root setup as much as I do, PLEASE consider donating to CrashXXL! He has done great work on this and donations help keep folks like him working on innovations for us.
Click to expand...
Click to collapse
I have been stuck on 7/16 flashing system.img in rsd for 6 hours now is that normal
---------- Post added at 05:11 AM ---------- Previous post was at 04:52 AM ----------
jblock92 said:
I have been stuck on 7/16 flashing system.img in rsd for 6 hours now is that normal
Click to expand...
Click to collapse
will i brick if i unplug reboot and give up?
gilbertiddi0 said:
Sorry, I'm real lazy and don't not speak windows hardly at all.
Say I have one of those cool chargey factory cords and I wanna use linux to do all this, is there any reason I couldn't just plug the phone in with that cord, use a bash script something like this:
Code:
#!/usr/bin/bash
python qdloadSYS1.py MPRG8960.bin -ptf _SYS/partitions.txt
python qdloadSYS2.py MPRG8960.bin -ptf _SYS/partitions.txt
python qdloadSYS3.py MPRG8960.bin -ptf _SYS/partitions.txt
python qdloadSYS4.py MPRG8960.bin -ptf _SYS/partitions.txt
python qdloadSYS5.py MPRG8960.bin -ptf _SYS/partitions.txt
and go wash dishes (I am real lazy and ain't not done them in awhile)?
I see some notes on flashing blbroke in betwixt each step is why I ask. Not that I really want to wash dishes er nuthin'. It doesn't fix the bootloader at each step does it? If so, is there some re-write on the qdload that could allow the whole shebang in one step? Given I have one of those factory cords (and a short attention span)?
Again, this hinges on having a factory cord that allows you to disregard the state of the battery.
Click to expand...
Click to collapse
I'm not sure about Linux, but the reason it is broken into 5 steps is because your battery will not last long enough to do it all at once. You have to run blbroke each time because the script fixes your boot loader so you can boot into fastboot to charge your battery. (It won't charge in qdload mode from my understanding.) All this is from crashxxl's original post on the Russian forums and he knows what he is talking about.
Sent from my locked but not stocked XT1080.
---------- Post added at 08:15 AM ---------- Previous post was at 08:13 AM ----------
jblock92 said:
I have been stuck on 7/16 flashing system.img in rsd for 6 hours now is that normal
---------- Post added at 05:11 AM ---------- Previous post was at 04:52 AM ----------
will i brick if i unplug reboot and give up?
Click to expand...
Click to collapse
6 hours definitely isn't normal. Can you screenshot the window for us?
Sent from my locked but not stocked XT1080.
chuck864 said:
I'm not sure about Linux, but the reason it is broken into 5 steps is because your battery will not last long enough to do it all at once. You have to run blbroke each time because the script fixes your boot loader so you can boot into fastboot to charge your battery. (It won't charge in qdload mode from my understanding.) All this is from crashxxl's original post on the Russian forums and he knows what he is talking about.
Sent from my locked but not stocked XT1080.
---------- Post added at 08:15 AM ---------- Previous post was at 08:13 AM ----------
6 hours definitely isn't normal. Can you screenshot the window for us?
Sent from my locked but not stocked XT1080.
Click to expand...
Click to collapse
it failed, now i cant even get past 2/16 flashing gpt.bin

system.img firmware only -from 10F KDZ file

HERE is the system.img firmware only from 10F KDZ file, should work with all variants of the G4 (i hav'nt tried it myself yet, as im away in hospital all day)
DOWNLOAD HERE
It's google drive so quata will go fast, so if youd like you can mirror it.
Download the system.zip file and extract it.
instructions by TEAM_CodeFire modified by smaberg
1.) install all windows driver and adb, fastboot files, download and extract LG_Root for appropriate files http://d-h.st/uO8h
2.) Enable ADB debugging on your device, Go to Settings > About Phone > Software Information and tap build number until you are presented with "You are now a developer"
Exit back to Settings main screen. In Developer Options enable USB Debugging (Some devices require enabling PTP for debugging to work)
3.) In the root of LG_Root folder start a command prompt, Inside of LG_Root folder hold shift and right click a blank space you should see "Open command window here"
4.) Well that was easy , let's continue (Now that we have the files on our device we want to put our device is download mode)
Power off your device
When the device is powered off, hold volume up and insert a USB cable connected to the PC
Wait for the drivers to install
5.) Let's find which COM port our device is connected to
Double click ports.bat (This will give us the COM port in which our device is connected we are looking for the Diag port)
Let's run Send_Command.exe (It couldn't connect? Make sure you COM port number is correct it varies)
Code:
Send_Command.exe \\.\COM3
6.) in command prompt Type "id" and press enter (no quotes).
You should get back some text starting with "uid=(0)root gid=(0)root". If not, press CTRL-C, and do step 9 again (the application sometimes doesn't respond on the first command).
7.) in command prompt type
dd if=/data/media/0/system.img bs=8192 seek=55296 count=529920 of=/dev/block/mmcblk0
For other variants then eu815 look here
8.) After a few minutes of sitting, you should get back a "#" prompt. This indicates the process has finished.
Type "LEAVE" (no quotes) and press enter. Your phone should reboot. DONE!!!!!!!!!!!!!!!!!!!!!!!!!!!
Click to expand...
Click to collapse
All flashing is on your own risk, i cant help if you get a seagull in your face
It´s rooted?
no, stock at the moment.
No possibility to have a zip file? I do not have windows, but only Mac.. with a zip file for who has the unlocked bootloader is simpler
I tried it on my Sprint variant but it did not work.
emilyrugburn said:
I tried it on my Sprint variant but it did not work.
Click to expand...
Click to collapse
Ofc, its for the H815.
is it possible to change the build.prop in this .img before i flash it into my G4?
Could you post a link to the 10f kdz file?
Where did you get that? Was there another update this week?
speedzioch said:
Where did you get that? Was there another update this week?
Click to expand...
Click to collapse
Look at the date of the OP. This was posted weeks ago.
There are different version upgrade paths for different G4 devices.
For example, my TWN (Taiwan) device latest is 10C. You should really only use the version designed for your own device.
You're right. I didnt check that after being redirected here from rooted img thread. This software misleading stuff provided by LG is confusing. Sorry once again.
LG G4 H815 ®
when I flash the system.img I lose the exfat support for sdcard , I downgraded back to v10E with kdz flash and it fixed sdcard issue.
I will be very thankful to get 10F kdz
I think this way I won't lose exfat support .
Hey nechmadi,
i'm quite sure that any available KDZ is and will be listed here http://storagecow.eu/index.php?dir=Xda/LG+G4/ (link is from this thread). depending on what device you are using (it appears to me that there's a mess with version numbers among carriers etc... i'm using a no-carrier H815 international device) v10d/e* is the latest.
(sais v10d in UI, but v10e in build.prop)
my humble advice, stick with what you have, enjoy your sd card and just wait for future upgrades to see the light of day
edit:
hmm, i see 10f mentioned here.. i didnt get anything 10f related so far... since i'm using a dull no-carrier device i think that's where 'LG updates' arrive first? i'm fairly new to this whole ordeal so take anything i say with a grain of salt - however i'll stick to my previous statement. sit and wait

NTCODE Error Solution

1. Go to secret menu of your phone (*#546368#*850#)
2. Tap SVC menu, then Version Info.
3. In Version info find NT Code.
4. Change wbatever code you have there to "1","FFF,FFF,FFFFFFFF,FFFFFFFF,11" - that is open europe.
After pasting the above code, the NT Code should display something like code write done, or similar, instead of your old NT Code.
This info is from MrBeem, he sent to me. I have this error but it did not work for me, i get Write Error maybe because i I dont have root. If you are rooted can work for you.
I get write error too. I think you have to have root to make this work.
Talking of which, has anyone got root on 7.0 yet?
stuclark said:
I get write error too. I think you have to have root to make this work.
Talking of which, has anyone got root on 7.0 yet?
Click to expand...
Click to collapse
From Mrbeem:
Hello. Got an update on the version error you have/had.
1. yes, you do have to be rooted, to get root u must het twrp-3.2.0-1-beta1-H850.img and SuperSu2.78 SR4. You flash twrp via minimal adb and fastboot, instructions on XDA forum, after flash, pull battery out, back in and you MUST get to recovery by Vol Down+POWER combination and you only get 1 try. If you don't manage to get to recovery and your system starts booting, you must flash twrp all over again. Once in TWRP, press skip if it prompts for password, enable read/write by swiping right, and install SuperSu zip file you have to have on your external sd card. With all that done, reboot and voila, you're rooted.
2. After boot, go to hidden menu, to ntcode. In the ntcode put "1","FFF,FFF,FFFFFFFF,FFFFFFFF,FF" notice, last 2 are FF, not 11. you should get NTCODE WRITE OK
3. with root acces granted go to cust folder and enable R/W option. I recommend using root explorer 4.0.4
4. Check subfolder list in cust folder. You will have folders like VDF_OP, EUR_OP or something like that. Pick any and memorize its name. this will become your soft ver. after you finish.
5. Find file named cust_path_mapping.cfg and open it with TEXT EDITOR!
6. at the end of the document, add a following line: FFFFFF,FF=/cust/name of subfolder in cust folder you memorized in step 4
7. save file, close it and reopen to check if your added line sticks. if it doesn't you haven't pressed "mount R/W" button in root explorer. Press "mount R/W" and repeat steps 5 to 7 .
8. Reboot, and now you should get your system branded (if you chose a specific carrier subfolder in /cust) or no brand and no version error (if you chose open europe in /cust).
Error
yken said:
From Mrbeem:
Hello. Got an update on the version error you have/had.
1. yes, you do have to be rooted, to get root u must het twrp-3.2.0-1-beta1-H850.img and SuperSu2.78 SR4. You flash twrp via minimal adb and fastboot, instructions on XDA forum, after flash, pull battery out, back in and you MUST get to recovery by Vol Down+POWER combination and you only get 1 try. If you don't manage to get to recovery and your system starts booting, you must flash twrp all over again. Once in TWRP, press skip if it prompts for password, enable read/write by swiping right, and install SuperSu zip file you have to have on your external sd card. With all that done, reboot and voila, you're rooted.
2. After boot, go to hidden menu, to ntcode. In the ntcode put "1","FFF,FFF,FFFFFFFF,FFFFFFFF,FF" notice, last 2 are FF, not 11. you should get NTCODE WRITE OK
3. with root acces granted go to cust folder and enable R/W option. I recommend using root explorer 4.0.4
4. Check subfolder list in cust folder. You will have folders like VDF_OP, EUR_OP or something like that. Pick any and memorize its name. this will become your soft ver. after you finish.
5. Find file named cust_path_mapping.cfg and open it with TEXT EDITOR!
6. at the end of the document, add a following line: FFFFFF,FF=/cust/name of subfolder in cust folder you memorized in step 4
7. save file, close it and reopen to check if your added line sticks. if it doesn't you haven't pressed "mount R/W" button in root explorer. Press "mount R/W" and repeat steps 5 to 7 .
8. Reboot, and now you should get your system branded (if you chose a specific carrier subfolder in /cust) or no brand and no version error (if you chose open europe in /cust).
Click to expand...
Click to collapse
Can't pass the step 2, it gives an error.
fmartins29 said:
Can't pass the step 2, it gives an error.
Click to expand...
Click to collapse
You can flash your countries Rom, not EU
I've installed TWRP ans SuperSU as shown above, but I still get Write Error.
Looking in the SuperSU app, it says under "Install SuperSU into /system" - "Not (currently) available in system-less mode".
How can I fix the SuperSU issue, as I'm guessing that's why I haven't got write access to the NTT code?
Hi. What exactly do you get in your ntcode error? Mine was FFFFFF,FF is not a proper code or something like that. Now, if your error is something else but not '0', you can just do the following:
1. Memorize or write down your error code ( in my case it was FFFFFF,FF)
2. go to /cust folder, mount it as R/W
3. Check what carrier subfolders folders you have in your cust solder (i had OPEN_EU, P4P_PL and a couple more)
4. Open file cust_path_mapping.cfg with TEXT EDITOR
5. Change the number/letter string before = of your desired carrier in the above mentioned cfg file to whatever it says in your ntcode error (my error message said FFFFFF,FF, i wanted the P4P_PL to be my carrier so i changed 26006,06=/cust/P4P_PL to FFFFFF,FF=/cust/P4P_PL).
6. Save changes, close, reopen the cfg file to check if your changes stick (if not, make sure you've enabled the R/W option in your cust folder).
7. Reboot
This should fix your problem. I tried this on 5 different devices and always worked.
Help changing NT using SVC menu
yken said:
You can flash your countries Rom, not EU
Click to expand...
Click to collapse
The NT code showing for me on my LG G5 H850 from the SVC menu is
"3","234,30F,
28000000,FFFFFFFF,FF","234,38F,
28000000,FFFFFFFF,FF","234,33F,
28000000,FFFFFFFF,FF"
(I'm on UK Virgin I believe - 234,38) and my stock Android 7.0 Rom is H85020k_00_VMC_GB_OP_0501.kdz Now,
I want to update to Oreo using the open EU oreo kdz H85030a_00_OPEN_EU_OP_0910.kdz as an upgrade file is not yet available for my phone but I get the customer not found errors on boot even if I first flash the phone using the original stock open EU Android 7.0 file H85020a_00_OPEN_EU_OP_1030.kdz.
I have my phone unlock code so if I unlock the bootloader will that allow me to enter a new NT code in the SVC menu to stop the customer error message without me having to root the phone and edit the root CUST folder? Thanks in anticipation.
wimmerfield said:
The NT code showing for me on my LG G5 H850 from the SVC menu is
"3","234,30F,
28000000,FFFFFFFF,FF","234,38F,
28000000,FFFFFFFF,FF","234,33F,
28000000,FFFFFFFF,FF"
(I'm on UK Virgin I believe - 234,38) and my stock Android 7.0 Rom is H85020k_00_VMC_GB_OP_0501.kdz Now,
I want to update to Oreo using the open EU oreo kdz H85030a_00_OPEN_EU_OP_0910.kdz as an upgrade file is not yet available for my phone but I get the customer not found errors on boot even if I first flash the phone using the original stock open EU Android 7.0 file H85020a_00_OPEN_EU_OP_1030.kdz.
I have my phone unlock code so if I unlock the bootloader will that allow me to enter a new NT code in the SVC menu to stop the customer error message without me having to root the phone and edit the root CUST folder? Thanks in anticipation.
Click to expand...
Click to collapse
Just wondered if you got any further with this? Oreo is now released for VM branded G5, but I'm wanting to use my VM branded phone on Three with WiFi calling. I was thinking about changing 1 of the 3 NT Codes (30,33,38) to 20 for Three but not sure if that's the best path forwards.
No progress with changing NT code
cancunia said:
Just wondered if you got any further with this? Oreo is now released for VM branded G5, but I'm wanting to use my VM branded phone on Three with WiFi calling. I was thinking about changing 1 of the 3 NT Codes (30,33,38) to 20 for Three but not sure if that's the best path forwards.
Click to expand...
Click to collapse
Sorry - I wasn't able to resolve that issue but as you say the G5 has now received its Oreo upgrade which is really all I wanted. Good luck anyway
Thank you! It worked for me. I have an h850ar running Android 8.0 without root. Finally the damn sign went away every time I started my phone ...
my device 860 h GCC middle East
I FLASH OREO VERSION sg (Singapore)
everything is work but ( NTCODE) PROBLEM ? ANY solution ? your discussion work for my device?
thank you
sorry bad English ?
WARNİNG
1 - WARNİNG - Current version is not available for user. Can't find matched cust for NTCODE = (23430,02)
2- WARNİNG _ Current OP name by Buyer-code is (EEO_GB). But cannot find matched NT-code mcc/mnc (23430), subset (02)
Telefon yeniden başlatıldığında bu hatalar çıkıyor bir çözüm var mı acaba LG G5 H850 model cihaz
Did anyone work out how to change the NT Code via the hidden menu? I tried downgrading to Marshmallow but still get a write error.
Thanks
This is a solution that worked for me, on a Wind branded phone with an OPEN_EU rom (root required):
go to /cust/ folder and edit cust_path_mapping.cfg, adding a new line with the code you see in the NTCODE error (22288,FF in my case), pointing it to the OPEN_COM folder:
22288,FF=/cust/OPEN_COM
Then do the same with open_path_mapping.cfg, but here you should put OPEN_EU instead of OPEN_COM:
22288,FF=OPEN_EU
Then, after saving both files, reboot the phone, and the NTCODE error will be gone.

*UPDATED**UNLOCK TOOL (4-2019) for ALL Versions of BLU R1-HD

BLU R1-HD bootloader unlock script tool, and TWRP install tool.
Download is a zip file, unpack it to somewhere you will remember. Run the dirty-cow-tool.bat // mtk-su-tool.bat
The included files and folders are set to hidden, in effort to keep them safe from accidental delete.
Must have adb+fastboot + drivers installed and setup prior to using tool
Easiest method to install adb + fastboot on windows is with "15 second adb + fastboot install TOOL"
LINK==>ADB+FASTBOOT
It is for windows
In linux :
"sudo apt-get install android-tools-adb"
"sudo apt-get install android-tools-fastboot" Some fastboot commands were missing when i used this one ie "fastboot flashing get_unlock_ability"
"sudo apt-get install fastboot" worked better when I tried. ( i used that command as a check before doing the unlock, so it was needed only for that check)
Using Tool
On Windows?
Unzip the downloaded file to a new folder, open new
folder and click on "dirty-cow-tool.bat". // "mtk-su-tool.bat"
Do the steps in order (1-2-3-4) to be unlocked, then
Step (5) to get to second page where step (1) is root
The rest is optional
On Linux?
Unzip downloaded file to new folder folder .
Open folder. Then open R1-Linux-tool-v2 folder
Open terminal from that folder and type
" . R1-HD-TOOL.sh "
Same order of steps (1,2,3,4) step (5) for extra
Steps (1 on second menu) for superSU root.
Second menu steps (2,3,4,5,6,7,8) are optional.
**Linux Note**
The tool uses "fastboot flashing get_unlock_ability" as one of the methods to check before doing the unlock.
The version of fastboot that installed with "apt-get install android-tools-fastboot" did not recognize
this command. But "apt-get install fastboot" updated some version and then the command was recognized.
******OTHER NOTES****
--- this has been mentioned in the general thread and the modified v17 thread, but It has come up again so I wanted to make note of it.----
--- The newest blu versions (V7.4.2 and V17) Have made changes to "toolbox" and this effects things like "adaway" and "titanium backup"
--- The suggested fix is to install busy-box. I have had success with the version from play store, some prefer to use f-droid version. Either one will do. Install it and open the app. From in the app you need to do an install.
CHANGE LOG
V1:. Initial release : removed
V2:. : fixed typos preventing proper function
V3:.: switch file verification to md5 check instead of "ls-l" comparison.
V4: current version: add extras page, add SU flash, de-bloat script, Added Fm Radio, Added pre-loader roll back
V5: Fixed wrong loop "goto" line that made preloader rollback do "MTK_BLU Debloat v2" instead
V6: Added manual pause to script for mods that need recovery (Extra's 5) . Added redundent recovery flash command .
Few reports of recovery "not Sticking" and needed to run the flash commands manually one by one. Maybe the redundent
flash will make it survive. If still having problem with recovery "staying install" try manually flashing
here is link to the steps needed. FLASH RECOVERY
V7 Improved logs Added line to make batch run as sub-process so if error occurs , will not close
V7.1 : Updated the fm radio install zip and include the needed selinux mode changer app
V8: fixed dependency of needing to be unzipped to location w/o spaces in name. (when used from location with spaces, tool used to fail to push needed files).
.. added more time to allow dirtycow to "spawn" its root shell. Recent testing has shown sometimes it takes longer than the 60 seconds allowed in the script. Now it is looped 3 times.
V9 Added full path to abd push lines for recovery flash files. included fastboot.exe file to address some version issue where user s version would not output text file I coded into script for a verification ( included file is called by script, no need to do anything different with it)
V10: Moved zip file to included folder to help preserve locations when unpacked, added device check before running tool; So tool not used on wrong device, Rearranged order of operations on extra's page. (recovery installed options) Push files while in android before rebooting to recovery( should improve reliability for multiple reports of not automatically installing options for some)
******I have received some reports that some devices are reporting "ro.build.product =R1_HD and not "BLU_R1_HD" like mine, so the added device check is blocking tool from starting If this happens to you , you can make edit to the .bat file like below.
Change this line
Code:
:next_check
find "BLU_R1_HD" "%~dp0workingproduct.txt"
To this
Code:
:next_check
find "R1_HD" "%~dp0workingproduct.txt"
it is line #23
V11: Updated device model verification lines
MTK-SU: Replaced all dirty-cow part with New MTK-SU binary(elf) from @diplomatic
source
Click to expand...
Click to collapse
Credits to @Diplomatic for his work on the Mtk_su that I used used to make this tool work again after Dirty-Cow was patched.
DOWNLOAD LINK
Preferred to use the Downloads tab of this thread.
Archived downloads on android file host also == link
XDA:DevDB Information
R1-HD Dirty-cow Unlock Tool, Tool/Utility for the BLU R1 HD
Contributors
mrmazak, vampirefo for his recovery, lopestom for his recovery, emc2cube for his debloat zips, christianrodher for his dirtycow method,
Source Code: https://github.com/mrmazakblu/DirtyCow-R1_HD
Version Information
Status: Testing
Current Stable Version: V11
Stable Release Date: 2017-04-11
Current Beta Version: MTK-SU
Beta Release Date: 2019-04-14
Created 2017-02-22
Last Updated 2019-04-18
Reserved
Items planed to be addressed in next release:
--Add few more file integrity checks to the extra's page
--Add copy log to clipboard option so it is easier to post log entry if needed-------*********----already-_added to github copy of batch file
--Add a verification step that checks what recovery is installed( to prevent trying to do steps on extra's page with stock recovery)
--Possibly move to a "fastboot boot recovery" instead of "adb reboot recovery" for the same reason as above
--Add wget or similar to the extra's items so initial "TOOL" size is smaller (not that 40-50MB is big, but to some it may be )
--Add additional "selinux mode changer apk" for fm radio install rather than just the note that says it needs to be found.
Reserved
Works great on OEM 6.6, thanks for the tool!
So I got the one-click-root.sh done, maybe. Can some linux users go over it, make sure I didn't do anything stupid? I don't exactly have a device to check it with atm, and I am not pro with scripting, barely novice, so it is a pretty basic conversion of the batch file. Still, it might work . Just would like a few eyes on first.
https://github.com/theredbaron1834/Scripts/blob/master/one-click-root.sh
Also, I looked at dirty-cow-tool.bat. However, wow, more an advanced batch file, and I am not sure what the first half does, so not sure how to convert . However, it seems if anyone does get it, the eqiv of goto for linux is funtions. simple cheatsheet:
Code:
function stuff {
echo "this stuff is run via the function"
{
stuff #goes to stuff and runs function
theredbaron1834 said:
So I got the one-click-root.sh done, maybe. Can some linux users go over it, make sure I didn't do anything stupid? I don't exactly have a device to check it with atm, and I am not pro with scripting, barely novice, so it is a pretty basic conversion of the batch file. Still, it might work . Just would like a few eyes on first.
https://github.com/theredbaron1834/Scripts/blob/master/one-click-root.sh
Also, I looked at dirty-cow-tool.bat. However, wow, more an advanced batch file, and I am not sure what the first half does, so not sure how to convert . However, it seems if anyone does get it, the eqiv of goto for linux is funtions. simple cheatsheet:
Code:
function stuff {
echo "this stuff is run via the function"
{
stuff #goes to stuff and runs function
Click to expand...
Click to collapse
thank you for your input.
As far as the begining of the batch, It is adding a few folders to the "path" variable so help ensure the "adb push" commands find the files it is trying to push. Then it sets some folder "flags" to hidden so that the files the batch needs don't get accidentally moved or changed. Then the large section with mostly "echo" that is to set up the "simulated" G.U.I.
The lines of just "::::::::::" are simply used to help with reading the batch file. i use them to seperate functions. They are not needed.
The lines with only 2 "::" are standard windows comment / remark line entries
The lines with 1 ":" are the beginning line of the loop/ function == the line that "goto *" searches for
Does Works to unlock 7.4.2?
khyr said:
Does Works to unlock 7.4.2?
Click to expand...
Click to collapse
It is supposed to. It is the same base codes used from original script, and that one was confirmed to work. I Do not have first hand use of V7.4.2 so it is only confirmed through other users.
The dirty-cow being used has been patched by google in Dec but blu has not rolled out the patch. So there is no reason for it not to work.
edit:
I have the linux version ready.
-the first step, (ADB Push) is ready. including md5 file checks
-step 2 is ready= running dirty-cow with md5 check before final writing to mmcblk device
-step 3 is ready unlocking bootloader = including check if unlock is done, but need to fix the "unlock_adility" check
I can make to file to compare and grep the line needed, but cannot "sed" the extra information or do a > < comparison
-step 4 is ready .--flash twrp
Finished 90% of tool.
still need to tweek the log feature.
I ran tests on the lop back to menu and test ran
1. push files for dirty-cow and md5 check . then made push fail to verify the check method was valid ==pass
2. run dirty cow commands and md5 verification on resulting file. ==pass
3.unlock bootloader --- I ran it (needed to fake the already unlocked check) it works == pass
4 . flash twrp --installed both version i have, both install fine ===pass
5 extra menus -- ran . install su-----debloat---rebloat--- add fm radio--- preloader roll back =====all pass
(bootloader roll back needs manual intervention to re-enter fastboot during the boot loop that is unavoidable)
6. instruction ====not written yet
7. exit yes it closes == pass
8. logs --- needs completeing
I just loaded this on my OTA updated 7.4.2 device. I would note that the batch file does not actually create the /sdcard/Download folder so you might need to go into the terminal and actually create this on your sdcard... also worth noting that this batch file **requires** an sd card in the device to do any of the loads in the "5" menu.
torchredfrc said:
I just loaded this on my OTA updated 7.4.2 device. I would note that the batch file does not actually create the /sdcard/Download folder so you might need to go into the terminal and actually create this on your sdcard... also worth noting that this batch file **requires** an sd card in the device to do any of the loads in the "5" menu.
Click to expand...
Click to collapse
no it does not.
the /sdcard is the internal memory and the Download folder is already there.
you might be having issues but the folder is already part of normal system
mrmazak said:
no it does not.
the /sdcard is the internal memory and the Download folder is already there.
you might be having issues but the folder is already part of normal system
Click to expand...
Click to collapse
Fair enough, my restore didn't have /sdcard/Download and I made an assumption that /sdcard was my mounted card. Thanks for the insight.
OOPS
found typo on V4 of tool. batch files sets variables for "return", from loop functions. And two returns were set to same label9, so if you had tried to do extra's menu option #8. "ROLL Back Preloader" , instead it was running option # 5. " MTK_BLU Debloat v2"
fixed and still reading and re-reading to search for errors.
This looks bad.
The reason I put together this tool was I felt it was important to make a way to minimize the problems usually associated with android modifications. By making "typo's" a thing of the past, and I found them in my own script.
re-posted V5 combined with linux V2--
torchredfrc said:
I just loaded this on my OTA updated 7.4.2 device. I would note that the batch file does not actually create the /sdcard/Download folder so you might need to go into the terminal and actually create this on your sdcard... also worth noting that this batch file **requires** an sd card in the device to do any of the loads in the "5" menu.
Click to expand...
Click to collapse
I'm a total noob, and I'd like to know how to proceed with the supersu and all the other parts of step 5. Thank you
gabriel986 said:
I'm a total noob, and I'd like to know how to proceed with the supersu and all the other parts of step 5. Thank you
Click to expand...
Click to collapse
Ok. After you have completed upto twrp install. You can do the options on #5. It is all programed and automatic. What is does is put zip files onto the phone and reboots phone into recovery, then recovery installs them.
mrmazak said:
Ok. After you have completed upto twrp install. You can do the options on #5. It is all programed and automatic. What is does is put zip files onto the phone and reboots phone into recovery, then recovery installs them.
Click to expand...
Click to collapse
I get up to the recovery installation, but then I can not access such recovery on the phone, If I turn it on with power+vol up, it takes me to the default factory recovery by blu.
And If I try to the super su step with the phone on, it resets it, and get it to the screen with the dead android, while the script just shows the ADB DETECTED message.
In case it's needed, my R1 HD is running on
BLU_R0010UU_V7.4.2_GENERIC 09-11-2016 13:38
gabriel986 said:
I get up to the recovery installation, but then I can not access such recovery on the phone, If I turn it on with power+vol up, it takes me to the default factory recovery by blu.
And If I try to the super su step with the phone on, it resets it, and get it to the screen with the dead android, while the script just shows the ADB DETECTED message.
Click to expand...
Click to collapse
You missed a step in the process.
As tool finishes the recovery install it comes to a "pause" in the script, you need to hold the volume up button on phone "before" pressing button on pc keyboard to continue.
If phone does a normal reboot at this point then the system will replace the newly installed recovery with the stock one.
Giving you the situation you have now.
This step I cannot control, you must press volume button on phone to get the boot menu, and directly boot into recovery to ensure that the install sticks.
mrmazak said:
You missed a step in the process.
As tool finishes the recovery install it comes to a "pause" in the script, you need to hold the volume up button on phone "before" pressing button on pc keyboard to continue.
If phone does a normal reboot at this point then the system will replace the newly installed recovery with the stock one.
Giving you the situation you have now.
This step I cannot control, you must press volume button on phone to get the boot menu, and directly boot into recovery to ensure that the install sticks.
Click to expand...
Click to collapse
trying again....
for how long should I press the volume up key?
gabriel986 said:
trying again....
for how long should I press the volume up key?
Click to expand...
Click to collapse
When tool says Hold button , keep it held. Then continue the script. Phone should reboot to the boot menu. Then let go of volume
Some phones do not accept the fastboot reboot command, on those phones need to hold power to shut off. Then volume and power together to come on, release power when screen come on
mrmazak said:
When tool says Hold button , keep it held. Then continue the script. Phone should reboot to the boot menu. Then let go of volume
Some phones do not accept the fastboot reboot command, on those phones need to hold power to shut off. Then volume and power together to come on, release power when screen come on
Click to expand...
Click to collapse
ok.. trying again
---------- Post added at 02:00 PM ---------- Previous post was at 01:46 PM ----------
gabriel986 said:
trying again....
for how long should I press the volume up key?
Click to expand...
Click to collapse
it beat me!
I get stuck in that part of the process, If anyone uploads a video to check what i'm doing wrong, I'll be grateful.

Update LG G4 H818P to android 7 by LG-H815 Official v29A.

Installing the H815 Nougat Stock [v29A] on the H818P.
5.1 Installation
1 - Download KDz from 5.1;
2 - Put the phone in download mode and open the LG UP;
3 - Load KDz into the program and start;
4 - I hope to connect, configure and depart for the next procedure.
Root process
1- Download all files;
3 - Download IMG from the V10C BRASIL system or V10D Brasil (check the version of your software), after downloading and downloading the IMG to the internal memory of the device.
4. Install the drivers (if you do not have one) and extract the LG_Root.zip to the LG Root folder;
5- On the device, enable USB Debugging in the Developer Options;
6- In the LG Root folder, right-click pressing shift and click Open Command Window here.
7- Connect the USB cable to the computer and allow debugging;
8- In the open command window type adb.exe devices, so if the device is connected the computer will inform in the window. Example: List of devices attached, LGH818P (letters and numbers), device;
9- Disconnect the USB cable and the device. With it off, press the volume more, plug into the USB port, the device will turn on Download Mode;
10- Go back to the folder, with the device already in Download Mode, double click on the Ports file, it will open another command window, copy the port number that appears in \ Device \ LGANDNETDIAG1 REG_SZ COMxx, note the xx because it is the number of the door, write down the number, then close the window that has been opened;
11- Go back to the command window that you had previously opened, in it copy and paste the command Send_Command.exe \\. \ COMxx and change the xx by the number of its port;
12- Still in the window, type id, a message will appear. Example: uid = (0) root gid = (0) root. If it does not, type again;
13- It's time for root, you should be sure now that you have copied the correct port and that the file from step 2 is in the internal memory. Enter the command
dd if=/data/media/0/system.rooted.H81510c-EU.img bs=8192 seek=55296 count=529920 of=/dev/block/mmcblk0
and hit Enter on your keyboard. It should take about a minute, wait until # appears.
14- After you finish, type LEAVE for your device to reboot. Root is done.
Installing Nougat
1 - Right after Root download the Flash Fire, and install it;
2 - Copy to rom for internal storage, compact even;
3 - Right after pressing the "+" and select the option "Flash ZIP or OTA";
4 - Ira appears to navigate the internal memory, select the rom;
5 - Then select the "Flash" option;
6 - It will restart and soon after starting the installation;
7 - Ready, now just wait;
NOTE: In the LG logo it will take a little, something from 3 to 5 minutes.
DOWNLOADS :
V10C_BRA_root.rar: https://mega.nz/#!Y1lQWDrY!ItgAfCNX7oO1XPLLS9hT3WLDi3MBQ0LOe6vPoMtut-I
V10D_BRA_ROOTED.zip: https://mega.nz/#!Ro8XVBqC!EDbYZ9weJj7Pn3ewLB9hEy6ZjGiRCX_igtt5kPZLADE
Drivers: http://www.lg.com/br/suporte/suporte-celular/lg-H818P
LG Root: https://mega.nz/#!4xNBAIiZ!TR9kHjYMaHKZLg2Fm8ceGffGTMiWSmP8Q0bBxuOkFxQ
Stock Rom: https://lg-firmwares.com/lg-h818p-firmwares/#firmwaresList
LG-H815_Official_v29A.
https://www.androidfilehost.com/?fid=817550096634794247
IF YOU WANT DOWNGRADE 7.0 TO 6.0
SEE ALL HERE
http://raspberryjuntopi.com.br/2017/10/13/off-downgrade-lg-g4-do-nougat-para-o-marshmallow/
https://www.youtube.com/watch?v=9Vk1TJ96eG4&feature=youtu.be
FILE H815 V20o Modded.kdz
you can drop from 7.0 to 6.0 and run the manual modem
The easiest way to get it manually (you need root):
Copy the IMG-file of the modem in the internal storage (do not rename it!)
on your computer, the command ADB line
Execute «adb shell» (without the quotes)
Lift the skin with the command su (again, without quotes)
Then execute the following commands:
dd if = / dev / zero of = / dev / block / platform / bootdevice / by-name / modem
dd if = / sdcard / modem_h818p_20h_gcc.img of = / dev / block / platform / bootdevice / by-name / modem
Finally, restart your phone and it should work.
modem_h818p_20g.img
https://mega.nz/#!e5snTbaL!BYplWw8MAyNFWJ0VrrA4UZjV0Ric3-RxIRUsELZjk1c
6.0
https://mega.nz/#!H8dnXDCL!hqA-yIN3dAeuqHm-H0KltL6rfTJfb0EpVcNJYkkr0GU
hi,
Can I Root & Flash that Nougat ROM on my G4 H818P that is currently on Marsmallow?
thanks
BoyBawang2 said:
hi,
Can I Root & Flash that Nougat ROM on my G4 H818P that is currently on Marsmallow?
thanks
Click to expand...
Click to collapse
NO. you lost signal.
If you try to Flash kdz file but it stops at 9% with error 0x2000 flashing fail .
Try replacing your LGUP dll with this one: LGUP_8994.dll
https://mega.nz/#!b51GGDLL!n42yqpAIaEbgbx8WkoB8DtDAERx3N8tsHhPkC_XDs5M
It's located in this directory:
C:\Program Files (x86)\LG Electronics\LGUP\model\8994
Or this one if you have a 32-bit windows pc:
C:\Program Files\LG Electronics\LGUP\model\8994
And then flash KDZ again
hochocnua said:
NO. you lost signal.
Click to expand...
Click to collapse
Thanks. Can I atleast succeed just on the Rooting part?
BoyBawang2 said:
Thanks. Can I atleast succeed just on the Rooting part?
Click to expand...
Click to collapse
No Root For Marshmallow and Nougat
Sent from my LG-H818 using Tapatalk
Hi, if i flash Nougat this way will I lost network (and dual sim)?
alitavas said:
No Root For Marshmallow and Nougat
Click to expand...
Click to collapse
Thanks. The instructions should have indicated that I should be in Lollipop first before going through the steps.
Future, can i flash firmware h818p normally?
BoyBawang2 said:
Thanks. The instructions should have indicated that I should be in Lollipop first before going through the steps.
Click to expand...
Click to collapse
Sorry - but can you read?
If you read the instructions, you can't miss that Part ?
Yupppiiiii....
Sent from my LG-H870DS using XDA-Developers Legacy app
Please help me...
I successfuly installed nougat on my H818P, but when downgrading i am stuck in download mode, on kdz flashing it always stuck at 25%. In download mode it says modified in red color.
phone is identified as H81529a
esco_448 said:
Please help me...
I successfuly installed nougat on my H818P, but when downgrading i am stuck in download mode, on kdz flashing it always stuck at 25%. In download mode it says modified in red color.
phone is identified as H81529a
Click to expand...
Click to collapse
You must downgrade with kdz file of H815 MM and flash moderm after that.
You must downgrade with kdz file of H815 MM and flash moderm after that.
Click to expand...
Click to collapse
I tried that, It's always showing invalid kdz.
esco_448 said:
I tried that, It's always showing invalid kdz.
Click to expand...
Click to collapse
you need a kdz v20p/MM for H815 and extract dll from it, then replace the old dll from your LGUP dir & and flash your kdz MM for H818.
thank you for the guide
I am using (h815 singapore locked) but I am at europe
1.flashed (H81510C_00_2.kdz -android 5.1) with Lgup
2.flashed rooted (system.rooted.H81510c-EU.img)
3.repated ur guide for nougat
and all works fine for me
thanks
the_naxhoo said:
you need a kdz v20p/MM for H815 and extract dll from it, then replace the old dll from your LGUP dir & and flash your kdz MM for H818.
Click to expand...
Click to collapse
Thanks for your help.
But now it's stucking at 11% (PrimaryGPT step). I am geting this: error message:
Error: Error Code = 0x2000,
Invalid command response
esco_448 said:
Thanks for your help.
But now it's stucking at 11% (PrimaryGPT step). I am geting this: error message:
Error: Error Code = 0x2000,
Invalid command response
Click to expand...
Click to collapse
hm ok, try to extract the dll from your kdz MM H818 and replace the dll again.
Thanks to all, I just restored my device.
I modified H81520p_00_0314.kdz with winhex and replaced H815 with H818P. Used LGUP for flashing.
Can I still use dual sim after 7.0 by h815

Categories

Resources