Database Users

How are the RUU nv_*.nb files used?

In the RUUs, along with all the standard images (boot, system, userdata, recovery) there are nv_*.nb files. I presume they are for writing nvram, not NAND (that is, not into mtdblockX partitions). I think we have only seen two variants so far (zifnab06, pls correct me if I am wrong).
643ce1350c9157501014b5b29cb5e30d nv_1.85.nb (both HTC 1.5 "Cupcake" RUUs)
b70cfb0e203c6c0e35081849d4ea5e1f nv_2.11_0103_PRL58005_full.nb (all three 2.1 RUUs: leak, root, "OTA")
Note that during the RUU update process, activity relating to this file type is never made apparent (for instance in the same way that progress messages are shown for every other image file in the RUU "rom.zip" file).
So, here are my question(s):
-Q1) Will the bootloader do something meaningful with them if you push the .nb file with fastboot?
-Q2) If so, what "partition name" do you use with fastboot, e.g.: fastboot flash ?????? nv_1.85.nb
-Q3) If you drop one of these into a (jarsigned) zip file for use with Amon_RA's recovery, will it do anything meaningful with it (or just ignore it and leave it in the / directory ?
These questions arose in the context of trying to demonstrate that you can roll backwards from 2.1_ROOT to factory 1.5 using the S-OFF bootloader and the unpacked contents of the 1.5 RUUs. (The S-OFF bootloader is perfectly happy to let you overwrite it with an older hboot file using fastboot) You can roll back the radio with fastboot, but wouldn't you also want the corresponding nvram contents if you were going revert to (unrooted) factory 1.5?
BTW, I nearly borked my phone doing this. In the middle of flashing the "system" partition, I got a bad block write, and that led to a cascade of failures: re-installing only the S-ON bootloader and recovery partitions (battery pull method followed by fastboot for recovery) wasn't sufficient, as recovery complained about both the "system" partition and "misc" partitions. The solution was to install the complete 2.1_root RUU - apparently the bootloader re-initializes all partitions. That sort of makes sense, as there may be reasons for HTC/Verizon to resize partitions from release to release.
That does lead to my fifth question, though:
-Q5) Does anyone have a useful URL that points to docs (or a HowTo) for the repair tools in Amon_RA's recovery (in particular, "parted") ?
TIA
bftb0

[Guide] Unlocking HTC Desire HD using HTCDEV method and installing CyanogenMod

I'm pretty new here but as I documented the process of modding my own phone I thought I'd share it with you. I didn't invent any of these processes and this information is available from many different sources. I've tried to credit any source material that I've used verbatim. I am by no means an expert.
Please reply back with any corrections and I'll be happy to edit the post.
This guide describes how to take a HTC Desire HD (mine was fully patched with OTA updates including Sense 3.0), unlock it and install CyanogenMod onto it. It worked for me but it might not for you. I don't take any responsibility for you turning your phone into a brick!
Pro Tips
Remember, in any steps requiring the phone to be powered off, just give it a minute to make sure that it is properly turned off.
Understand what's happening! If you get what's going on, you've more chance of fixing it if it goes wrong. This process describes how to use HTCs official method to unlock the bootloader. This allows you to change the operating system on the phone. The phone contains a recovery system which we an engineer can boot into to replace the main operating system if it becomes unbootable. We are going to replace this stock recovery system with a modified one which allows us do fiddle about with the phone's internal partitions. Once we have the modified recovery system in place we use it backup the existing phone operating system and replace it with a modified one. We can also use it to restore the original one again if things go wrong.
Read all of the instructions properly first! Don't go off half-****ed!
As far as I'm aware you can't reverse the official HTC bootloader unlock (i.e put your phone back *exactly* as it was) and it may effect your warranty. You have been warned!
Unlock the Bootloader
INFO: You can use the HTCDEV unlock bootloader method from HTC as an 'official' means of unlocking the bootloader. Confused? Check out the official site: http://htcdev.com/bootloader/ I'm not going to describe it step by step here because HTC do that quite well enough themselves.
Quick tip. If when going from one step to another on the HTC website you come to a white screen, that may be because you've been logged out. Just go back to the first page, log in again, then go back to the last step you completed.
Another quick tip. Make sure you properly install everything HTC tells you to. We'll need it all later...
Installing recovery mode
INFO: The stock recovery mode itself is pretty basic and can't do much, so we need to replace it with a custom recovery image.
We're going to use the clockworkmod recovery image which you grab from here: http://dl.dropbox.com/u/4518713/archive/recovery-clockwork-5.0.2.7.111102-j_r0dd_mod-ace.zip (originally seen here: http://forum.xda-developers.com/showthread.php?t=1118865)
Make sure that the fast boot mode on your phone is disabled. You can find this in your power settings menu.
If the phone is connected via a USB cable then unplug it.
Power off the phone using the power button and leave it alone for a minute.
INFO: To flash the new recovery image to the phone, you need to reboot the phone into the bootloader so that you can select a new image to boot. The bootloader is known as HBOOT.
Boot into HBOOT by holding down the 'volume down' button and pressing the power button.
By default FASTBOOT is selected so just press the power button to access it.
Attach the USB cable and note that FASTBOOT changes to FASTBOOT USB
On your PC open cmd prompt and cd to the platform-tools directory of the android sdk. Mine is at C:\Program Files (x86)\Android\android-sdk\platform-tools>
Copy the .img file from the clockworkmod zip file we downloaded earlier to the platform-tools directory. Rename it recovery.img
Go to your command prompt and issue this command:
Code:
fastboot flash recovery recovery.img
INFO: The recovery image will then be written to your phone, and as long as everything went well you'll get a message saying OK.
Ensure that BOOTLOADER is selected in the HBOOT menu and press POWER button to select it. Now you're back at the HBOOT menu.
Use the volume buttons to highlight RECOVERY and press the power button to select it. After showing you the HTC logo, the phone should boot into recovery mode!
Backing up your phone
Using the volume buttons to select move to the 'backup and restore' option in the menu. Use power to select and use the backup option. This backs up your current phone setup to the SD card.
Select power off to turn off you phone. Leave it a few secs - select reboot system now.
When your phone is backup and running, mount it in mass storage mode and navigate to the root of your SD card. See the folder called 'clockworkmod'? copy that along with everything in it to your computer and put it somewhere safe. That's your backup. If needs be, you can use this backup your phone back to the original state!
Installing CyanogenMod (other mods may vary)
Mostly taken from http://wiki.cyanogenmod.com/wiki/Nexus_One:_Full_Update_Guide with some extra stuff that messed with me when I tried to do it.
Download the latest version of CyanogenMod from http://download.cyanogenmod.com/?type=stable&device=ace
Download the Google Apps for the device. http://wiki.cyanogenmod.com/wiki/Latest_Version/Google_Apps
Place the CyanogenMod update.zip file on the root of the SD card.
Place the Google Apps .zip on the root of the SD card also.
Boot into the ClockworkMod Recovery.
Once the device boots into the ClockworkMod Recovery, use the side volume buttons to move around, and the power button to select.
Select the option to Wipe data/factory reset.
Then select the option to Wipe cache partition.
And the option to wipe the Dalvik cache
Select Install zip from sdcard.
Select Choose zip from sdcard.
Select the CyanogenMod update.zip.
Select Install zip from sdcard
Select Choose zip from sdcard
Select the Google apps zip
These extra steps seem to have been required by people in this thread. All credit due to marsdta and theluckster for their suggestions. I've edited this guide to include the instructions here where they are more visible.
On your computer extract the ROM zip (e.g. update-cm-7.1.0-DesireHD-signed.zip) and there should be a file inside it called boot.img. This should be flashed automatically, however for some reason via the HTCDEV method it is not.
To do it manually, you need to enter fastboot mode, as per the instructions above:
Boot into HBOOT by holding down the 'volume down' button and pressing the power button.
By default FASTBOOT is selected so just press the power button to access it.
Attach the USB cable and note that FASTBOOT changes to FASTBOOT USB
Then on your PC, in the directory you extracted the zip file run:
fastboot flash boot boot.img
Click to expand...
Click to collapse
Once the installation has finished, select Go Back to get back to the main menu, and select the Reboot system now option. The phone should now boot into CyanogenMod.
Now wait for what seems like an incredibly long time with the phone showing the 'htc' screen.
INFO: The phone should now boot into CyanogenMod!
Restoring your phone - When things go wrong
OK, so you flashed a bad mod. Time to restore.
First up, put the backup you made in the previous step onto the root of your SDcard (if it isn't already there). Then, I came across this video which seems to explain things pretty well
http://www.youtube.com/watch?v=mUYGe8mmNWU
The basic gist of it is, boot into recovery mode, format the cache, data and system partitions, wipe the Dalvik cache, then restore the backup from your SD card.

Wow thanks a lot!
I personally have 1 problem:
Step 12 of the "installing recovery mode" when i type in the command in command prompt is says:
'error: cannot load recovery.img'
I placed it in the same folder as fastboot en renamed it "recovery.img".
I unlocked the bootloader succesfully btw..
Any thoughts?

I think you should contemplate using attn1's ace hack kit to gain bootloader unlock instead of voiding your warranty.

Hunt3r.j2 said:
I think you should contemplate using attn1's ace hack kit to gain bootloader unlock instead of voiding your warranty.
Click to expand...
Click to collapse
Well I've already unlocked the bootloader through htcdev.
But tried the Attn1's as well...ended up saying:
/data/local/tmp/goldcard.img: cannot open for read: No such file or directory
starting downgrade...
** The phone will now reboot into HBOOT.
** It will then check the file just sent.
** If everything is okay, the phone will
** prompt you to continue by pressing
** VOLUME UP. It will reboot, flashing twice.
The phone did not prompt me to continue by pressing volume up.
When i start clockwork recovery it states i should root my phone...
So a lot going wrong and i can't figure out what..

how long the htc screen? I'm waiting for a looooong time

Thanks for the tutorial. I've followed the instructions and managed to unlock the bootloader and install ClockworkMod, however after flashing CM7 and rebooting it is stuck on the H3G boot screen (isn't flashing CM7 supposed to overwrite the boot logo?). I'm trying to flash:
update-cm-7.1.0-DesireHD-signed.zip
gapps-gb-20110828-signed.zip
I've double checked /data, /system, /cache and Dalvik-Cache have been wiped before flashing but still no avail
Here are the versions from the bootloader:
***UNLOCKED***
ACE PVT SHIP S-ON RL
HBOOT-2.00.0029
MICROP-0438
RADIO-26.14.04.28_M
eMMC-boot
Dec 22 2011, 14:28:19
I am able to restore the backup, but flashing any other ROM just doesn't boot.

The guide is missing one key step . Flashing the boot image.
So after flashing your from boot back into boot loader and flash your roms boot.img.(just copy it over to your fast boot file)
Then run the command
Fastboot flash boot boot.img
Reboot . Done.
You'll have to do this every time you flash different roms. 4ext has a nice feature of doing this for those that have HTC unlocked you should try it out
Sent from my Inspire 4G using XDA

Awesome, thanks marsdta! It is working now, good work!

thelucster said:
Awesome, thanks marsdta! It is working now, good work!
Click to expand...
Click to collapse
can you repeat it more clear for me because i have the same problem.
Thank you Thelucster. You have saved me from a big mistake.

crom1 said:
can you repeat it more clear for me because i have the same problem
Click to expand...
Click to collapse
First flash the Cyanogen ROM and Google Apps, as per the instructions above. Then on your computer extract the ROM zip (e.g. update-cm-7.1.0-DesireHD-signed.zip) and there should be a file inside it called boot.img. This should be flashed automatically, however for some reason via the HTCDEV method it is not.
To do it manually, you need to enter fastboot mode, as per the instructions above:
Boot into HBOOT by holding down the 'volume down' button and pressing the power button.
By default FASTBOOT is selected so just press the power button to access it.
Attach the USB cable and note that FASTBOOT changes to FASTBOOT USB
Click to expand...
Click to collapse
Then on your PC, in the directory you extracted the zip file run:
fastboot flash boot boot.img
Click to expand...
Click to collapse

I didn't set notifications on this post and forgot it existed till today. I've updated the guide with the information posted by marsdta and theluckster to make things clearer. Sorry about any confusion caused by missing that step out.

the boot screen shows cyanogen(mod)7 instead of the regular HTC sign!! Following each and every step I landed up here. And now I am stuck, cuz this boot screen has been there for like half-an hour....does it mean something is wrong or does it take this much time to load first???

Hello,
for HTC dev unlocked bootloader (about what is added after step 15 in "installing cyanogen" phase) : it seems that the boot.img must be flashed before installing the .zip from sdcard.
I got stuck for that. Could be worth to make it clear.
Great tutorial anyway, thank you !

zarkenciel said:
Hello,
for HTC dev unlocked bootloader (about what is added after step 15 in "installing cyanogen" phase) : it seems that the boot.img must be flashed before installing the .zip from sdcard.
I got stuck for that. Could be worth to make it clear.
Great tutorial anyway, thank you !
Click to expand...
Click to collapse
It shouldn't matter. I've seen people do it both ways and it worked fine for them.
@ash win. Your in a boot loop. Did you do a full wipe before flashing? Could be just a bad flash. Go back and reflash the rom and boot.img. you should also verify the md5hash to make sure yous didn't get a corrupt download file.

Just finished the tutorial, works perfectly. Thanks for writing it.

Does this unlock you from the network, i.e. is this the alternative to paying £15 for an unlock code?
I do understand this is for modding and flashing to a new ROM, but I am wondering if it also unlocks the phone from your network (or maybe that is IMEI based).
This is not for any illegal purposes, just I fancy a new ROM and I am now out of contract, so happy to experiment with flashing.

ohforfs said:
Does this unlock you from the network, i.e. is this the alternative to paying £15 for an unlock code?
I do understand this is for modding and flashing to a new ROM, but I am wondering if it also unlocks the phone from your network (or maybe that is IMEI based).
This is not for any illegal purposes, just I fancy a new ROM and I am now out of contract, so happy to experiment with flashing.
Click to expand...
Click to collapse
No, you need the aahk for that. That gives you sim unlock as well. Just Google attn1 aahk and you'll find it

marsdta said:
No, you need the aahk for that. That gives you sim unlock as well. Just Google attn1 aahk and you'll find it
Click to expand...
Click to collapse
Thanks - very kind of you to point me in the right direction, I've found it

Hi,
and how do i root my phone after HTCDev Unlock??
I want install the Custom Rom "Sabsa Prime". Do i need root to flash it?
Sorry for my bad english.

You may also want to include wiping battery stats in the advanced option of cwm in your guide

Stock Nexus 4 - 4.4 OTA not working

Hi forum,
this is my first post here and I am writing this on behalf of my missis, so bear with me should I not state the obvious or ask too easy stuff. I am normally an iOS user and have not had frequent contact with updating / flashing / rooting Android devices.
The Nexus 4 in question is completely stock, nothing has ever been rooted / flashed or updated. The device runs 4.3 (JWR66Y) for some time now (I know, I know... but she is rather non-technical) and for quite some time it's failing to accept the OTA update of KitKat 4.4 (KRT16S). The device downloads the update in the background and notifies about it's existence in the notification area. From there you are able to agree to the update, the device reboots, the update process starts to run and then it just fails with the image of the lying Android mascot just stating "Error".
From there you can just reboot the handset normally into Android OS. Subsequent attempts of the update continue to fail, even after a factory reset.
I have now tried to manually update with the following file http :// android.clients.google.com/packages/ota/google_mako/c7d8660af65b878835d5248252f51dcbf53c2001.signed-two-step.signed-occam-KRT16S-from-JWR66Y.d1b99704.zip and the ADB toolset from the official Android SDK Bundle on Linux. I can properly get the device into recovery mode, get it to the point where it accepts sideloads and then I just issue adb sideload <filename of the above mentiond .zip>. So far, so standard.
The file transfers, update starts but it aborts the install because an existing file does not match the expected content: EMMC:/dev/block/platform/msm_sdcc.1/by-name/modem
Google research suggest this is the case if you have rooted the device before or tampered in some way with the bootloader. No such thing happened here - this is the most standard Android device possible. It hasn't even been attached to a PC before.
I also find various requests to extract the radio.img or modem.img from the stock JWR66Y image and flash it with fastboot. On the one hand I am not sure how do this (all tutorials I can find do this as part of a complete, destructive flashback which I am not seeking to do) and on the other hand I fail to understand how this file's checksum can deviate from the expected value. Is it corrupted or has it been updated by the provider? The handset has been bought regularly directly from Google and is used in Germany. Reverting it to a file from the stock factory image will not cause any problems with the modem?
Any pointers or help are well appreciated.

What is the baseband version listed in settings -> about phone?
If your radio version isn't the listed:
Code:
M9615A-CEFWMAZM-2.0.1700.84
or any of the ones listed here: Nexus 4 Stock Roms - XDA wiki you may actually have a version that noone else does. (or possibly a modded version)
Assuming you have already unlocked your bootloader, it would be:
Code:
fastboot flash radio radio-mako-m9615a-cefwmazm-2.0.1700.84.img
with the radio extracted from the JWR66Y factory image, if you wish to update via ota.
If you have not unlocked your bootloader, then you will not be able to update at all unless you unlock it and wipe your data.
(as you mentioned the contents of the baseband do not match the expected one)
-------------------------------------------------------------------------------------------------------------------------------------------
If it's not any of the above versions, you could possibly have a previously unknown version.
If that's the case, could you dump it before updating?
To do that, the simplest way would be to boot a custom recovery (such as clockworkmod) with the following:
Code:
fastboot boot <path to recovery.img>
and after it loads
Code:
adb shell dd if=/dev/block/platform/msm_sdcc.1/by-name/modem of=/sdcard/newmodem.img
-------------------------------------------------------------------------------------------------------------------------------------------
If you wish to manually update, you can download the KTU84P factory image and flash it on top of your existing rom with the following commands:
(extract the contents of image-occam-ktu84p.zip from occam-ktu84p-factory-b6ac3ad6.zip)
Code:
fastboot flash bootloader bootloader-mako-makoz30d.img
fastboot flash radio radio-mako-m9615a-cefwmazm-2.0.1701.03.img
fastboot flash boot boot.img
fastboot flash recovery recovery.img
fastboot flash system system.img
and that'll force update it without wiping data. Keep in mind you MUST flash both the bootloader and radio together or you will not be able to use cellular services.

[UNLOCK][UNOFFICIAL][G4] Unlock ANY* LG G4 device with UsU

About
UsU = Unofficial secureboot-off/steadfasterX Unlock
*works with any G4 model. Even though the h818 can be unlocked as well the touch display does not work anymore (should be possible to resolve but.. read on).
so I decided to remove it from the UsU unlock. Read the details and process here: h818 topic
This will "unlock" your bootloader and so enables you to install TWRP and custom ROMS as you like.
To be honest unlock is not the correct wording but I will still refer to it as unlock as the result is the same:
UsU will disable "Secure Boot" which verifies signatures on several partitions like: boot and recovery. Disabling secureboot means it will still verify and give you a secure boot error on boot BUT it will ignore and just boot afterwards (similar to a regular unlock).
This is the outcome of a loooooooong finding process. long? I started with the first attempt in this over 1 year ago. yes.. (think about my nickname heh?!)
A lot of stuff happend since then which all together helped me to accomplish UsU at the very end (yes all these links are my work including some brave testers ofc! ).
You wanna know how this big puzzle fits together?
UsU is not just an unlock! Its a combination of massive changes in TWRP, the G4 kernel and providing all the tools around like FWUL or SALT!
It was really my biggest project in android development and its not just providing the actual unlock files
Hijacking the boot process via EFIdroid, TWRP in FIsH and FIsH in general
AntiRollback and firehose(!) findings
Partition tables for any G4
mAid (fka FWUL) because I needed a valid base for all my testers (one of the reasons why I started FWUL)
The LG-Up replacement and now unlocking tool SALT ! Without SALT this all would be absolutely crazy risky and absolutely nothing for the average user!
many many unlock methods/theories (and millions of times soft and hard bricked) in my PoC thread
while unbricking I found a way to unbrick even when QFIl fails with my sdcard unbrick method
hard-hard bricked (no other recovery then by LG / chip replacement) for 4 times.. (thanks ILAPO!)
many TWRP tests and changes to detect UsU devices properly
HINT:
OPEN THIS THREAD IN A BROWSER!
NOT IN AN APP!
THATS THE ONLY WAY TO FULLY SEE EVERYTHING AS IT SHOULD BE
REQUIREMENTS
UsU does not care about a country version of a model (e.g. H815 TWN and H815 TUR are all referring to as H815).
So you will find only the main part of your model listed which means it will work for any of them!
1) Your device should be one of these (SALT will detect your device and only allows to flash for these variants):
LS991
F500
H810
H811 (wth? yes that works but.. you can unlock OFFICIALLY! its just a fastboot command!)
H812 (NOTE: firmware: v20x or higher is strictly required before flashing!)
H815 - any non EUR
H815 EUR (wth? yes that works but.. you can unlock OFFICIALLY! its just a login on the LG website)
disabled: H818 (KNOWN ISSUE: TOUCH STOPS WORKING! current state)
H819
US991
VS986
Note: SALT will tell you which ROM type is compatible with your device within the main screen: GPT compatibility
Yes there is a way to flash also H815 ROMs on those who do not support it out-of-the-box but this is very risky and requires either a change of the partition table or the ROM build developer need to change the fstab (riskless for you)
2) ARB less or equal 2
So ARB 3,4,5,........ WILL NOT WORK!!
Details:
Just use SALT to identify your current ARB and read here how to identify and verify: G4 AntiRollback
* Reason:
UsU is based on an ARB 2 based aboot (part of the bootloader stack - see FAQ #27) and so ARB > 2 will hard-hard brick your device if you would flash UsU on it. Hard-Hard brick means no way to recover other then sending for repair.
3) Your device firmware must be MM(keep Requirement #2 in your mind when upgrading to MM)
which one? I highly recommend the latest MM version for your model --> but again beware of the ARB (not greater then 2)!
H812 devices need special attention though: v20x or higher is strictly required before flashing!
Details:
Yes you can flash and use UsU even when on LP but believe me: you don't want to. You will encounter issues sooner or later when runnin LP so take your time and upgrade your device to MM before proceeding here.
LIMITATIONS / KNOWN ISSUES
(bootloader stack is explained and described in FAQ 27)
1) Do not use QFIL or flash any KDZ / TOTs or any ROM containing a bootloader stack (like v29a pure does) ! You WILL loose unlock and may hard-hard-brick your device (at least HARD BRICK)!
2) Do not use QFIL or flash any KDZ / TOTs or any ROM containing a bootloader stack (like v29a pure does) ! You WILL loose unlock and may hard-hard-brick your device (at least HARD BRICK)!
3) Do not flash any MM or N bootloader stack containing the file named: aboot. This will immediately lock your device and so definitively HARD BRICK!
4) If you want to flash a MM or N modem partition (aka firmware) you need to re-flash <model>_UsU_basebands_flash-in-twrp.zip otherwise you will bootloop, stuck on boot or see a blue screen with a modem crash (this may change if I ever get my kernel module working...)
5) If a ROM has no active developer or the developer has not made it UsU compatible you may need to open the ROM zip file on your PC and change the update-script within (just remove the assert line(s) at the top is enough)
6) The fastboot mode coming with UsU will enable fastboot flash but the command fastboot boot will not work (like on the semi-official N bootloader stack)
7) Most important: Once you go this way - there is (maybe) no way back! SERIOUSLY. The only way to make the device exactly like before is replacing the mainboard. If you're scared: good.
Read the new findings on that part here - some models may be able to revert UsU!
Think twice and don't complain later if you go on!
8) Do not use QFIL or flash any KDZ / TOTs or any ROM containing a bootloader stack (like v29a pure does) ! You WILL loose unlock and may hard-hard-brick your device (at least HARD BRICK)!
9) video framerates are lowered after flashing UsU. This is due to the fact that required files for high performance video will not load properly anymore and so must be replaced. Replacing those firmware files is a risk and as it is working ok enough for the most users that patch will not be included in any ROM. If you really think you need this patched ensure you read the instructions here thoroughly and understand them 100% before proceeding to apply it: G4-VideoLag-Fix
YES I REPEATED MYSELF 3 (THREE) TIMES (... for a reason)!
Code:
#include <std_disclaimer.h>
/*
* Your warranty is now (maybe) void (well not really but just for the case...)
*
* I'am not responsible for bricked devices, dead SD cards,
* thermonuclear war, or you getting fired because the alarm app failed. Please
* do some research if you have any concerns about this howto/unlock method
* before using it! ---> YOU <--- are choosing to make these modifications, and if
* you point the finger at me for messing up your device, I will laugh at you.
*
*/
Downloads
YES. ALL of them:
Latest unlock package by steadfasterX (download the one for your device model only) --> <model>_UsU_unlock.zip (mirror)
Latest baseband package (download the one for your device model only) --> <model>_UsU_baseband_flash-in-twrp.zip (mirror)
Latest TWRP (PREVIEW-103 or higher!) by steadfasterX
- Nougat TWRP (if you plan to use + flash Nougat ROMs)
- Oreo TWRP (if you plan to use + flash Oreo ROMs)
- Pie TWRP (if you plan to use + flash Pie ROMs)
A custom ROM of your choice (see Requirements topic to find a compatible one!) --> e.g. all newer builds here: http://leech.binbash.rocks:8008/
Linux: I highly recommend to use mAid . This is an android lovers live ISO which can be booted from an USB stick which has everything needed on board - including SALT!
Latest mAid *persistent* by steadfasterX (HAVE TO be version 2.6 or later!): maid.binbash.rocks
only if NOT using mAid:
Latest SALT version (minimum version: v3.19!) by steadfasterX: SALT
Important note about bootloader/modem stuff!
You will find on several ROM threads the hint that you must have a specific bootloader stack (FAQ #27) in order to make the ROM working properly.
What in reality is needed on these ROMs is just the MODEM (aka firmware) partition nothing else. Believe me I know this for sure
1) Flash required modem partition in TWRP or fastboot mode
2) if using a ROM which is NOT specific an UsU ROM: Flash your baseband package (<model>_UsU_baseband_flash-in-twrp.zip) in TWRP again!! If you don't you will get bootloops, android hanging on boot or modem SoC crashes (blue demigod screen)
Flash UsU with SALT
(requires SALT v3.21 / mAid v3.2 or higher)
Before proceeding ensure that you have read and understood the "Limitations" topic and the "Changes in behavior" topic in this thread!
If you have a Windows PC the easiest way to get SALT is by flashing mAid v3.2 or higher on an USB stick (if you had read the "Downloads" topic above you should know that already).
Before you ask if there is a Windows version of SALT: read the FAQ in the SALT thread.
UsU can be flashed in 3 different ways! Every way will unlock your device the only difference is where you place the UsU files. Choose the one which fits best for you:
by an external sdcard (must be VFAT formatted)
by using your internal storage
by direct flashing (only when available - SALT will show this option only when possible for your device)
OK enough about all this: LETS UNLEASH YOUR DEVICE!
At very first: ensure you are using the LATEST version of SALT!
SALT contains an internal updater and when a new version has been detected online it will display an upgrade hint. DO THAT if you see any. It doesn't hurt to also trigger the update process even if you see no popup just to be sure that you have the latest version. You can also check the SALT release notes and compare the version with yours (title of the SALT window displays your version).
That step is really easy but incredible important. Do not miss that!
Just to say it again as its crucial important: USE THE SALT UPDATER to ensure you have the latest version!
Extract <model>_UsU_unlock.zip and copy the aboot_UsU.img, laf_UsU.img and rawres_UsU.img to either:
a) your external SDcard (directly on the external sdcard - not in any folder!). The sdcard must be formatted as VFAT.
or
b) connect your running Android device with your PC, select MTP mode in Android and copy it to the:
- "Internal Storage" and folder "Download" (exactly there!)
Start SALT
If you have not done already: DO A BACKUP NOW I'm serious this is your last chance to grab the important files and it just takes some minutes (in basic mode) but you have all in place if needed!
If you skip this step no one may can help you later!
Notice and WRITE DOWN the "GPT compatibility" info! DO NOT PROCEED IF IT STATES "unknown"
This part will become crucial important when it comes to which ROM you can flash!
The only valid information about that can be found in SALT!
If you see a "H811" there you have to flash H811 ROMs later (if no specific ROM is available for your model)
If you see a "H815" there you have to flash H815 ROMs later (if no specific ROM is available for your model)
If you see a "unknown" there you have to STOP and provide the SALT debug log (advanced menu)
Open the Advanced Menu
Click the "Unlock G4 (UsU)" button and read carefully the popup. Click Unlock, choose your unlock way and follow the instructions
If the UsU flashing fails for any reason (SALT will do important pre-checks and validiations before actually flashing):
If you see a popup about UsU flashing has partially failed do not be scared - just read and follow the instructions!
If you see a different error: do not reboot or power off the device! Ask for support and provide the debug log in SALT (in Advanced Menu -> Debug Logfile button -> Upload button and share the link)!
If the UsU flashing was successful (SALT will validate the flashing) continue:
Boot your device into fastboot mode (yes UsU has enabled an unlockedfastboot access for you!):
take out the battery
unplug the usb cable from the PC (not from the device)
Insert the battery again
wait 2 sec
press volume DOWN and while keeping it pressed: plug the USB cable to the device
keep volume DOWN pressed until you see the fastboot screen
Flash TWRP (yes you can do that now... because of UsU!):
fastboot flash recovery <twrp.img> (replace <twrp.img> with the real filename)
YOU MUST boot to TWRP now (you will notice a secure boot error but TWRP will load!):
disconnect USB cable
take out battery
put battery back in
press volume down AND the power button and keep both pressed until.. you see TWRP!
Gotcha! Try that with a locked phone and you will fail!
If you do not boot to TWRP after flashing it it will get OVERWRITTEN and you have to do all the steps for flashing TWRP again!
Optional (not needed when you flash an UsU compatible ROM later) Flash the baseband package now: <model>_UsU_baseband_flash-in-twrp.zip
While still in TWRP choose REBOOT menu and reboot to RECOVERY (yes again!)
Notice: TWRP will show your REAL device model when connected to the PC now.
If not: SHARE THE recovery LOG (how-to for grabbing the recovery log is written in FAQ #4A)!
I would say: its a good time to create a TWRP backup isn't it (ensure you also select "Bootloader" in TWRP backup)?
I HIGHLY RECOMMEND to do nothing else now. Just boot into your ROM as it is! Check if everything is working and proceed only if it boots fine and works fine!
Optional: just root now. Use Magisk or SuperSU to root your current installed stock ROM to see that it works
Done. Do not miss to read the Changes in behavior topic!
Whats next? Lol you are FREE! Flash SuperSu, Magisk or a custom ROM. Up to you. Flashing issues? Read the LIMITATIONS/KNOWN ISSUES topic (especially #1, #2, #3).
Changes in behavior
Booting to recovery, custom ROM booting (or stock but rooted), booting into download mode
You will notice a secure boot error ... and it will boot!!
... and NO: THIS MESSAGE CAN NOT BE REMOVED! If you can't live with that do not unlock
Fastboot
After you unlocked your device with this method you will also have an unlocked fastboot mode which can be accessed by a key combo:
take out the battery
unplug the usb cable from the PC (not from the device)
Insert the battery again
wait 2 sec
press volume DOWN and while keeping it pressed: plug the USB cable to the device
keep volume DOWN pressed until you see the fastboot screen
Now what? You can flash whatever you want here with: fastboot flash <partition> <filename>
you can NOT: fastboot boot .. as this is blocked like in the semi-official N bootloader stack.
TWRP/Recovery hardware key combo
Flashing UsU changes the way the regular factory reset screen key combo is working.
After flashing UsU we can boot directly into TWRP!
power off device
unplug the usb cable from the device (if any)
press volume DOWN + power button and KEEP THEM BOTH pressed the WHOLE TIME until you see "Recovery loading" or TWRP
Factory reset hardware key combo
As written above the regular key combo to get into the LG factory reset screen changes a bit:
power off device
disconnect any usb cable from the device
press volume UP + power button and KEEP THEM BOTH pressed until you see the LG logo the first time! THEN you have to immediately release the power button (ONLY that) and press and keep holding the power button directly again! Keep them pressed until you see the white LG factory reset screen
Proofs
Keep in mind: UsU will work for ANY LG G4 model and does not care about country specific ones, too! When I say: ANY, I MEAN any!
The only device which is a real special one because of different hardware (2 SIM slots) is the H818 which can be unlocked but has issues (see above)
confirmed:
check the current poll results: https://forum.xda-developers.com/poll.php?do=showresults&pollid=26680
LS991 (confirmed) --> https://forum.xda-developers.com/poll.php?do=showresults&pollid=26680
F500 (confirmed) --> https://forum.xda-developers.com/poll.php?do=showresults&pollid=26680
H810 (confirmed) --> https://forum.xda-developers.com/showpost.php?p=75126190&postcount=298 and https://forum.xda-developers.com/showpost.php?p=75736723&postcount=456
H812 (confirmed) --> https://forum.xda-developers.com/showpost.php?p=75126190&postcount=298
H815 (confirmed) --> My own one! and https://forum.xda-developers.com/showpost.php?p=75086602&postcount=276 and https://forum.xda-developers.com/showpost.php?p=75737617&postcount=458
H818 (confirmed)* --> https://forum.xda-developers.com/showpost.php?p=75133410&postcount=307 * SEE ABOVE REGARDING THE CURRENT ISSUES
H819 (confirmed) --> https://forum.xda-developers.com/poll.php?do=showresults&pollid=26680
US991 (confirmed) --> https://forum.xda-developers.com/poll.php?do=showresults&pollid=26680
VS986 (confirmed) --> https://forum.xda-developers.com/showpost.php?p=75109841&postcount=293
Support / Telegram
Of course in this thread but also by Telegram. I have created a generic group for all stuff around Android : here
and another one if you want to keep up2date whenever I build something (TWRP, SHRP, LOS, /e/, ...): here
Model specific ROM threads
H810:
- AOSCP Nougat
- LineageOS Oreo - general LOS all-in-one thread
- LineageOS Pie - all-in-one thread
- /e/ OS Pie - all-in-one-thread
H812:
- AOSCP Nougat
- LineageOS Oreo (deprecated) new: general LOS all-in-one thread
- AtomicOS
- LineageOS Pie - all-in-one thread
- /e/ OS Pie - all-in-one-thread
H815:
- AOSCP Nougat
- LineageOS Oreo (deprecated) new: general LOS all-in-one thread
- LineageOS Pie - all-in-one thread
- /e/ OS Pie - all-in-one-thread
VS986:
- AOSCP Nougat
- LineageOS Oreo (deprecated) new: general LOS all-in-one thread
- LineageOS Pie - all-in-one thread
- /e/ OS Pie - all-in-one-thread
any other model:
- LineageOS Oreo - all-in-one thread
- LineageOS Pie - all-in-one thread
- /e/ OS Pie - all-in-one-thread
Making the baseband flashing obsolete
Well time goes by and so things change in the meantime. I have found a way to make the baseband flashing obsolete but that requires to flash either a device model specific ROM or kernel.
That means:
When you flash a full UsU compatible ROM (like those linked above) there is no need anymore to flash the baseband package.
When you flash another ROM which is not fully UsU compatible you can flash a kernel with UsU patches and so can avoid flashing the baseband package as well.
The UsU kernels can be found here.
When the ROM is neither fully UsU compatible nor there is no kernel with UsU patches you can or better must flash the baseband package.
Credits
Mohd Saqib for the ls991 userdebug bootloader (https://forum.gsmdevelopers.com/lg-g-series-unified/32523-lg-g4-h811-boot-repair-qfil.html) stack. Without him.. no "unlock"
LG for making a faulty mainboard which allowed me to replace it without an issue several times after hard-hard bricking
Me - steadfasterX bc I have done all this almost alone (besides the brave testers ofc) AND: just for FUN ! (I *CAN* UNLOCK OFFICIALLY!) and as the the whole guide and method is the result of many many days ... lol noooo *MONTHS* (!!!) of spending my free time on this topic!
neutrondev (details about technical understanding + support)
uio88 (donator), jasonlindholm (recurring unteachable donator!), pablo103 (donator), britx (donator), ReeS86 (donator), ling751am (donator), 01189998819991197253 (donator), Korpse (donator), decibel_nv (donator), bdasmith (donator), hteles (donator), Leg0V0geL (donator), britx (donator), doop (donator), street_android (donator), ErismaSS (donator), ingcolchado (donator), fauxmight (donator), NwOg1984 (donator), pablogrs (donator), romanofski(donator), nenich78 (donator)
The overall sum (just for UsU) of donations (as of 2023-04-03): $252 !
While donations are accepted and appreciated there is NO need for it. I have done all this for fun and I like thx clicks more then money LOL
XDA:DevDB Information
Unofficial secureboot-off/steadfasterX Unlock, Tool/Utility for the LG G4
Contributors
steadfasterX, the_naxhoo (tester), SePhIrOtX (tester), Chebhou (tester), fawadshah33 (tester), DoughMucker (tester), shane87 (tester), Guy Noir (tester), networkkid (tester), ling751am (tester), jmfecon (tester), r3pwn (tester)
Version Information
Status: Stable
Stable Release Date: 2018-03-08
Alpha Release Date (PoC): 2017-07-28
Created 2018-03-08

FAQ
0) Is/will UsU be available for ARB 3 or higher?
no. never.
Reason:
UsU is based on an ARB 2 based aboot (part of the bootloader stack) and so any ARB > 2 will hard-hard brick your device if you would flash UsU on it.
(Hard-Hard brick means no way to recover other then sending for repair)
1) Is UsU reversible?
Yes and no.
Details: https://forum.xda-developers.com/showpost.php?p=76444983&postcount=968
2a) So I can't flash any KDZ/TOT anymore?
2b) So I can't upgrade my STOCK ROM with the LG updater anymore?
Have you really read the limitations topic? I guess no.
You can't! At least for the KDZ flashing part: not yet.
SALT will allow flashing of KDZ files with the upcoming version 4.0 but until then do not flash with lgup and do not use the LG Android internal updater --> You WILL 100% brick your device.
Why? Read the above FAQ.
3) Will UsU void my guarantee?
Sure.
4) I have flashed UsU and now in Android settings and/or in fastboot it shows up as a LG LS991 - WHY?
The aboot mentioned in FAQ 1) is from a specific device: the ls991. Usually this is nothing which you need to care about. What you see in the Android settings is just parsed from the commandline (means from what aboot is telling) and has no further impacts of nothing. Its just a wrong named "variable" thats it. I still work on a fix to adjust this on boot to your real model but atm of writing it would require a kernel for each model just for this cosmetic thing..
As the UsU fastboot IS ls991 as written in FAQ #1 you will see it there and this is unchangeable - but nothing you need to care about.
5a) I flashed UsU and now the ROM bootloops
5b) I flashed UsU and now the ROM does not start
5c) I flashed UsU and now Android crashes with a blue/purple demigod screen
5d) I flashed UsU and now I have no SOUND and/or CAMERA anymore
5e) I flashed UsU and now I have no cell service anymore
Well there could be 3 reasons why this can happen:
- Either you have not flashed the baseband package in TWRP
- you try to boot a ROM which is not compatible with your model (check the GPT compatibility in SALT!)
- or you have a very sensitive (or strict..) device model
The first thing you should try is flashing the UsU kernel for your installed ROM.
If there is no UsU kernel for your ROM install a supported ROM and flash the UsU kernel afterwards.
If the problem persists or if you still want to use the unsupported ROM: flash the baseband package and the GPT compatibility is ok with the ROM you trying to flash.
If the problem persists:
1 )Try to flash the modem partition of your SALT backup before flashing UsU (nothing else!)
if the problem persists:
2) Some devices require to flash the full modem partition of Lollipop (instead of flashing the baseband package) in order to work after UsU has been flashed so if you are sure that you flashed the baseband package go here and download the modem or the KDZ file of a 10 (Lollipop) modem.img/modem.bin: codefire if you cant find what you need try that one: storagecow
Flash the modem file in fastboot mode like this:
Code:
fastboot flash modem modem.img
or in TWRP like this:
Code:
adb push modem.bin /tmp
adb shell
dd if=/tmp/modem.bin of=/dev/block/bootdevice/by-name/modem
sync
reboot
6) Is there a windows version to flash UsU?
No and there will be never one. Why? For this FWUL exists. Flash FWUL on an USB stick and boot from it. It's as easy as it sounds.
7) I want to use a custom ROM based on Android Nougat or Oreo. In the ROM OP they say I need the v29a/N bootloader stack. Is this true?
No. You will find in several ROM threads the hint that you must have a specific bootloader stack in order to make the ROM working properly.
What in reality is needed on these ROMs is just the MODEM (aka firmware) partition nothing else. Believe me I know this for sure
If you later want to install custom ROMs based on N or O (any model! and any ARB) --> N modem
1) Flash G4_29a_N_modem_UsU.zip in TWRP
2) Flash your baseband package (<model>_UsU_baseband_flash-in-twrp.zip) in TWRP again!! If you don't you will get bootloops, android hanging on boot or modem SoC crashes (blue demigod screen)
When you have a H815(!!!!) device with ARB = 0 you COULD flash the complete bootloader stack though (if you wish - but as said it is NOT needed. READ MY LIPS: IT IS NOT NEEDED but its possible though ):
UsU bootloader stack for N / O
8a) I flashed a KDZ with LGUp / LG Flashtools (you really hexedited a kdz/tot just to brick your device? cooool)
8b) I flashed the non-UsU (see FAQ 7 for the UsU one) v29a bootloader stack on my device
8c) I have no idea why but i bricked my phone (actually you have but you don't wanna tell)
You will need an external sdcard or something like the infinity dongle. In theory there is also the way to unbrick by QFIL but this way is incredible dangerous if you use the wrong files (read FAQ #23!!). The external sdcard method will work only when your device is detected in 9008/QDL mode. If you connect your device to the PC and see nothing (Windows: device manager, Linux/FWUL: open a terminal and type: lsusb) then this guide will not work for you. The only chance is to use e.g. infinity or QFIL but there is no QFIL guide out there I would trust..
For the external sdcard unbrick read and follow the sdcard unbrick guide.
It is important that you know which bootloader stack you had on your device (in terms of ARB)
The only difference for UsU devices is that you need to flash:
the aboot_UsU.img to the aboot partition, the laf_UsU.img to the laf partition and the rawres_UsU.img to the raw_resources partition:
Code:
fastboot flash aboot aboot_UsU.img
fastboot flash laf laf_UsU.img
fastboot flash raw_resources rawres_UsU.img
9a) Will UsU work for my model?
Yes (h818 has been disabled though)
9b) Will UsU work for my country/region?
UsU has no restriction on a specific G4 model or country version.
9c) Will UsU work for any ARB?
UsU will work on ARB 0, 1 and 2 ONLY and you will need LP or MM to be able to actually flash UsU.
Again flashing UsU is a risk always. It happens on your own responsibility!
10a) Will UsU allow me to flash TWRP?
Yes.
10b) Will UsU allow me to flash stock ROMs?
Yes. You will be able to flash stock LP, MM, N
10c) Will UsU allow me to flash custom ROMs?
Yes. You will be able to flash any custom ROM of your choice (any android version)
10d) Will UsU allow me to root my device?
Yes. Ofc you can root with magisk as usual.
11) I follow your PoC thread since the beginning.. So UsU has no limitations regarding cell service/signal anymore?
Everything should work (cell service, mobile data, wifi, BT, call, sms, etc). UsU will not replace the complete bootloader stack as it was done in the early implementations.
By keeping your real bootloader stack the hardware like camera, modem / baseband can be initialized as it should and so no limitations are known (yet).
Again flashing an unofficial unlock is always a risk. Do not blame me when something is not working as it should.
You do this on your own responsibility
12) I want to flash a custom ROM but there is none for my model available what now?
SALT will show a field named GPT compatibility. Just flash a ROM which is compatible with your device. Thats it.
Read more about the compat check in SALT in the SALT FAQ #15.
13) I want to flash a custom ROM but it says "This ROM is for device xxxx but this device is >.< !! You told that I can flash any ROM so whats wrong here?
I wrote it in the LIMITATIONS/KNOWN ISSUES topic of the OP but here again:
Taken from the OP:
5) If a ROM has no active developer or the developer has not made it UsU compatible you may need to open the ROM zip file on your PC and change the update-script within (just remove the assert line at the top is enough)
Click to expand...
Click to collapse
Here a guide by @sdembiske https://forum.xda-developers.com/showpost.php?p=76405252&postcount=947
14) I have unlocked with UsU and all went fine. I flashed a ROM and it bootloops and now my phone died!! What have you done with my device? It never had this issue before in the last years!?
Unfortunately this is not UsU's fault. It's yours. Or better its LGs. The g4 is known to have faulty mainboard and when you boot a fresh flashed ROM this is very heavy cpu intensive and so can cause the ILAPO which means the hardware fault occurs. Yes it has not happened to you in the past but how often did you flashed a new ROM in the past? Ask LG for a mainboard replacement (yes even when out of guarantee) or check the bootloop fix it list : https://bit.do/ilapofixg4
15) I flashed the LP modem, but now it wont let me get past lockscreen. Do I need to factory reset?
background info: the modem partition contains decrypt parts so the screenlock may fail to decrypt.
Doing a factory reset is one option which will fix this.
If you dont want to loose your data reset just the password of the screen lock:
https://forum.xda-developers.com/android/software-hacking/remove-lockscreen-recovery-t3530008
16) I just wanna flash Nougat STOCK. Are there any worry free UsU downloads for it available?
Sure: here
After flashing ensure you flash your model baseband package!
After that and while still in TWRP: Choose Reboot -> RECOVERY ! This should ensure TWRP will not be overwritten on Android boot
17) What is the recommended way to backup with TWRP?
ONE/FIRST TIME backup. Do this just ONCE --> Select these partitions to backup:
Code:
- Firmware_Image
- EFS
- BL unlock state
- Bootloader
- Carrier
USUAL/DAILY BACKUP (e.g. to test other ROMs, before an upgrade, etc) --> Select these partitions to backup:
Code:
- Boot
- Recovery
- System
- Data
- Encryption metadata -> when your device is encrypted ONLY
- Firmware_Image
18) I have flashed the bootloader stack of N on my non-H815 device and now I have issues (no cell service, no bluetooth etc)
There could be 2 reasons why: Either you haven't read the OP guide properly and flashed the bootloader stack or you were one of the "early birds" flashed the full ROM which includes the Nougat bootloader stack.
H815-ONLY_ARB-0_29a_bootloader_UsU.zip (formerly named: G4_ARB-0_29a_bootloader_UsU.zip)
H815-ONLY_ARB-0_v29a_FULL-STOCK-ROM_UsU.zip (formerly named: G4_ARB-0_v29a_FULL-STOCK-ROM_UsU.zip)
The guide in the OP told you to do a SALT backup before flashing UsU.
If you have followed the guide properly you should have it and the above is one of the reasons why I said its required to do it.
( If you lost your backup there is still a way you can go: Follow FAQ #20 )
Open a terminal in the directory where you SALT backup before flashing UsU (or your extracted KDZ) is.
Then put your device in fastboot mode and type these commands:
Code:
fastboot flash factory factory.bin
fastboot flash hyp hyp.bin
fastboot flash modem modem.bin
fastboot flash pmic pmic.bin
fastboot flash rpm rpm.bin
fastboot flash sbl1 sbl1.bin
fastboot flash sdi sdi.bin
fastboot flash sec sec.bin
fastboot flash tz tz.bin
Read the output of the flashing on the screen and in your terminal. Do NOT flash anything else! Just the above - but ALL of the above! (if you miss a single file you will HARD BRICK)
If something is failing do NOT continue and try to re-do the above commands. if it still fails write in this thread or better come into IRC (when between Monday and Friday)!
If something failing here it WILL brick your phone.
19) I have flashed UsU but now I always see a secure boot error text at the top of my screen when booting (TWRP, Android, download and fastboot mode). Is it possible to remove that?
Really? I mean REALLY? Its clearly written in the OP - CHANGES IN BEHAVIOR !
20a)I have flashed UsU and now I want to downgrade/upgrade my bootloader stack. How?
20b)You were on LP or older MM firmware when you have flashed UsU and now having issues? -> Upgrade your bootloader to MM! Read here how:
Download a KDZ of your device model.
Keep in mind that there are frankenstein devices out there (means refurbished devices with mixed hardware inside so you think u have model XXX as it was shown in Android but the mainboard is NOT the same!).
How to identify a Frankenstein device? Read FAQ #21.
IMPORTANT: Check the ARB of that KDZ (SALT will show the ARB of a KDZ on extract!) - If you are unsure - DO NOT PROCEED. you can easily hard brick your device if!
Extract that KDZ with SALT - DO NOT USE ANY OTHER TOOL FOR EXTRACTING! The known windows tools like LG Firmware extract does not extract what we need here and not in the way we need it! So do not use that! You have been warned..
Open a terminal in the directory where you SALT backup before flashing UsU (or your extracted KDZ) is.
Then put your device in fastboot mode and type these commands (you have another file extension? read FAQ #24):
Code:
fastboot flash factory factory.bin
fastboot flash hyp hyp.bin
fastboot flash modem modem.bin
fastboot flash pmic pmic.bin
fastboot flash rpm rpm.bin
fastboot flash sbl1 sbl1.bin
fastboot flash sdi sdi.bin
fastboot flash sec sec.bin
fastboot flash tz tz.bin
Alternative with TWRP (if the above fastboot cmds work for you no need to do this!):
Code:
Boot TWRP
adb push factory.bin /tmp/
adb push hyp.bin /tmp/
adb push modem.bin /tmp/
adb push pmic.bin /tmp/
adb push rpm.bin /tmp/
adb push sbl1.bin /tmp/
adb push sdi.bin /tmp/
adb push sec.bin /tmp/
adb push tz.bin /tmp/
adb shell sync
adb shell "dd if=/tmp/factory.bin of=/dev/block/bootdevice/by-name/factory"
adb shell "dd if=/tmp/modem.bin of=/dev/block/bootdevice/by-name/modem"
adb shell "dd if=/tmp/hyp.bin of=/dev/block/bootdevice/by-name/hyp"
adb shell "dd if=/tmp/pmic.bin of=/dev/block/bootdevice/by-name/pmic"
adb shell "dd if=/tmp/rpm.bin of=/dev/block/bootdevice/by-name/rpm"
adb shell "dd if=/tmp/sbl1.bin of=/dev/block/bootdevice/by-name/sbl1"
adb shell "dd if=/tmp/sdi.bin of=/dev/block/bootdevice/by-name/sdi"
adb shell "dd if=/tmp/sec.bin of=/dev/block/bootdevice/by-name/sec"
adb shell "dd if=/tmp/tz.bin of=/dev/block/bootdevice/by-name/tz"
Download this verify tool to ensure the flashing was successful: [ATTACH]4687157[/ATTACH] ([URL="http://leech.binbash.it:8008/misc/verifyflash.zip"]mirror --> verifyflash.zip[/URL])
Usage:
extract verifyflash.zip
adb push verifyflash.sh /tmp/
adb shell chmod 755 /tmp/verifyflash.sh
adb shell /tmp/verifyflash.sh
Read the output of the flashing on the screen and in your terminal. Do NOT flash anything else! Just the above - but ALL of the above! (if you miss a single file you will HARD BRICK)
If something is failing do NOT continue and try to re-do the above commands. if it still fails write in this thread or better come into IRC (when between Monday and Friday)!
If something failing here it WILL brick your phone.
21)What is a frankenstein device and how can I identify if I have one?
A so called Frankenstein device shows up different in Android then it is in hardware.
Often happens on "refurbished" devices and almost everything you can buy on AliExpress is one.
The only way to identify your REAL model is by disassembling the device.
No there is NO other way. Everything else can be tricked by software.
Follow the guide here: https://www.ifixit.com/Guide/LG+G4+Motherboard+Replacement/51202
now you are able to see the REAL model printed on the front of your mainboard.
Is a Frankenstein bad? Hell yes. Can you live with one? Up to you. Technically there are good chances that it work as it should - especially when UsU'ing it.
Main problem here is that some stupid ppl out there take a board (often a h810 or h812 but there is no restriction) and flash a different PBL (primary boot loader) on it to load what they like to load. usually they flash h815 ROMs as that is best for selling as it can be unlocked officially (which NEVER works - as the IMEI and/or serial will never list a Frankenstein as a h815).
So actually it is not 100% clear what they did with your phone EXACTLY - and that leaves room for bricks when flashing stuff - or even worse: you might encounter partly not working stuff. In most of the Frankensteins I saw they work good when you flash the real models ROMs, bootloader stacks and modem partitions but well there is no guarantee for nothing here!
Other then that you can use SALT (part of mAid) to determine your model. This with the ARB shown gives you a 80 -90 % clue of your real device model.
E.g. when you bought a h815 (which is known to NEVER EVER have an ARB higher then 0) and it shows h810 in SALT then you can be 100% sure that it is not a h815 and 90% sure that it is the model shown in SALT instead.
22)I have a H812 and having issues after flashing the N stock ROM / AOSCP Nougat. What can I do?
Walk throughs:
Stock N report: https://forum.xda-developers.com/showpost.php?p=75913373&postcount=12 by user @grantdb (consider to show ur appreciation by clicking thx on that post)
AOSCP N report: https://forum.xda-developers.com/showpost.php?p=75890188&postcount=361 by user @sdembiske (consider to show ur appreciation by clicking thx on that post)
LineageOS O report: https://forum.xda-developers.com/showpost.php?p=76799406&postcount=1100 by user @sdembiske (consider to show ur appreciation by clicking thx on that post)
23)uhm I wanna / I have flashed with QFIL...
I wrote millions of times that using qfil is f*** dangerous and shouldn't be used.
The process of using QFIL with the wrong files can CONVERT your device or blow fuses! Never ever use qfil unless you REALLY understand what files you flash:
This requires to analyze the files (hexedit) you trying to flash with qfil. which is something 99% of the average user CAN'T.
Which means: do not use it unless you don't care about damaging your device ofc..
The only less-dangerous way is of unbricking from the 9008/QDL mode by my sdcard unbrick method but when you already used qfil you may have damaged your device already.
If you UsU'd your device there is even one more reason to NOT use qfil!
As said you shouldn't use qfil anyways but when you UsU'd your device it's even more important.
WHY I say using QFIL is evil?
Especially on devices which have no ARB >2 firmwares (like h812, h815, h818, h819 and F500) using QFIL is the worst idea you can have.
Just to be crystal clear: if you have UsU'd or not --> that doesn't matters!
QFIL is dangerous because:
some files you can find around will increase your ARB !
Increasing your ARB means you can never flash your original bootloader stack anymore (on devices having no ARB >2 firmwares)
If you can not flash your original bootloader stack anymore you can not load parts of the modem partition.
If you can not load these parts of the modem partitition you can not get any cell service - full stop. Yes here it ends. You can't go back and so you are stuck with like it is.
Well you can still go back by:
- replacing the mainboard
- replacing the cpu/whatever chip on the mainboard
There is ONE single exception to the above: If you have (still) a "nonfusing" device. Nonfusing devices may be able to flash any ARB but beware:
I had a nonfusing device which suddenly changed somewhen during my UsU hacking sessions.
I have one user who was able to flash a lower ARB then he had before because his device was stated as a nonfusing device. There is no guarantee but it is a chance for you.
Read more about the ARB background here: https://bit.do/unlockg4
24)I have a partition file with the extension: [ bin | image | img | mbn ]. How can I convert this?
The extension is not important. The way how you extract files - is. That's why I say all the time use SALT.
On Windows the file extension matters a lot which is not the case for Linux/Android.
There is no need to convert anything as they all are just raw image files.
25a)I have UsU'd but now in TWRP it does not show my model. Instead something like Chinese or strange characters.. How can I solve this?
25b)I have UsU'd but something went wrong while flashing..! I can still turn on the phone and I see the secure boot error.. What now?
25c)I have UsU'd but I cannot open the download mode anymore.. What now?
This can happen when you tried to flash UsU with a completely outdated version of SALT or using an unsupported version of FWUL (like using it in KVM, VMware ,..).
Ok how to fix this now?
Boot to fastboot mode.
Extract the UsU unlock zip file of your model.
Flash the following from that zip file:
Code:
fastboot flash raw_resources rawres_UsU.img
fastboot flash laf laf_UsU.img
That's it. TWRP will detect the model now correctly. If not share the TWRP log as described in the TWRP(!) thread FAQ 4a.
26a)How can I identify my bootloader stack from my backup files?
26b)How can I identify my current installed bootloader stack?
26a)
To find out which exact firmware version you had installed before UsU'd can be done easily when you have a backup (which you should have).
So to grab that info from your backup (requires Linux/FWUL):
Open a terminal in the directory where you have your SALT backup before UsU'd.
Then:
Code:
strings misc.bin | grep LG
It should display a long string containing your model name and the exact firmware version
26b)
There is no easy way atm for this. It is MUCH easier to just flash the newest bootloader stack like described in FAQ #20 in this post.
.. but if you really want something to start with:
a) do a SALT backup (basic)
b) extract sbl1 of any(!) KDZ files you can find for your model (you see now what a bad idea that is?)
c) do a md5sum on sbl1.img/bin (both: on your backup and the KDZ one) and compare. Once you have found a match you know the version.
27) a) What is the "bootloader stack" on the G4?
27) b) What is the boot process on a Qualcomm device like the G4?
The bootloader stack is a set of partitions (and optionally a partition table) which MUST be on the exact same firmware and ARB level.
There are exceptions to this but you really wanna risk a brick?
Keep the bootloader stack files together otherwise you will brick your device.
Why is explained in the following topic.
The LG G4's bootloader stack partitions are:
tz (Qualcomm Trust Zone. It performs low-level operations, including working with QFuses (rpmb secured mmc partition))
sbl1 (secondary bootloader)
sdi (trust zone storage partition. The data which is used by Trust Zone)
pmic (power management integrated circuit - related to rpm)
rpm (Resource and Power Manager firmware. Firmware for specialized SoC, responsible for resources and power)
aboot (<--- replaced by UsU ! so NEVER touch this again after UsU'ing) - Android boot, little kernel, lk, fastboot mode
hyp (Hypervisor - Virtual Machine Monitor, related to tz in order to protect the device/kernel - afaik)
Special partitions (NOT part of the bootloader stack - but either related, optional or as for the PBL - informative):
The following do not directly belongs to the above stack but it is related. You will never touch PBL, laf or raw_resources and the rest are optional ones.
PBL - Built-in ROM Qualcomm primary boot loader (read-only)
laf (download mode - can be anything on unlocked / UsU'd devices but for locked devices it MUST match the bootloader stack)
raw_resources - contains boot messages read by aboot. Examples: LG logo, bootloader has been unlocked warnings
recovery (recovery mode - can be anything on unlocked / UsU'd devices but for locked devices it MUST match the bootloader stack)
modem - hardware firmware (sound, baseband, camera, video, ...) accessed and loaded by rpm and Android (kernel, Android) - must STILL match the device's ARB of the bootloader! Otherwise those files cannot be read/loaded (most of them are signed so certificate protected!)
The boot process on a qualcomm device is as follows:
All of these partitions are signed by a certificate chain which starts in the PBL (which is read-only so cannot be altered - easily)
pbl  verifies and boots: sbl1 partition
sbl1 verifies and boots: tz, then: aboot
aboot verifies the next boot stage (boot / recovery / laf partition):
-> for locked devices: enforce verification result (so decline boot when failed)
-> for unlocked or UsU'd devices: print just a warning (so continue when failed)
For a graphical view: https://lineageos.org/engineering/Qualcomm-Firmware/ (G4 is: "2013-2016 Era")
28)a) I want STOCK - how can I revert back once I flashed a custom ROM?
28)b) how can I flash another version of any STOCK rom for my model?
for Nougat: FAQ #16
for any other:
extract with SALT system + boot + modem partition of the stock ROM kdz of your choice
(beware of the ARB!!! SALT will tell you on extracting the ARB and in the main window your device's ARB. do not flash anything higher then what the SALT main screen is showing or you might have a paperweight afterwards!!!! yes, even the system image can blow fuses!)
flash them in fastboot:
Code:
fastboot flash boot boot.img
fastboot flash system system.img
fastboot flash modem modem.img
boot TWRP (if you do not get into TWRP at the first try it gets overwritten. if that happens you must re-flash TWRP in fastboot)
flash the baseband package of your model
factory reset in TWRP (obviously all your data will be lost - so backup before)
if you encounter issues FORMAT data in TWRP (obviously all your data will be lost - so backup before)
29) I have a h810 and an ARB of 3 or higher. I heard there is a way to unlock this specific model somehow?! Is that true? If so how??
UsU will only work up to and including ARB 2 but the h810 is special as it turns out that its PBL (primary bootloader) SEEMS to be compatible with the h811.
There are 2 users reported that it worked for them but again this is EXTREMELY risky - especially on Frankensteins (i.e. refurbished models) !!!
I cannot guide you on that but check out my answer here: https://forum.xda-developers.com/showpost.php?p=80056484&postcount=1857
30) Video framerates are low(er) with UsU?
As mentioned in the OP above the video framerates might be lowered after flashing UsU.
This is due to the fact that the required files for high performance video will not load properly anymore and so must be replaced.
Replacing those firmware files is a risk and as it is working ok enough for the most users that patch will not be included in any ROM.
If you really think you need this patched ensure you read the instructions here thoroughly and understand them 100% before proceeding to apply it: G4-VideoLag-Fix
ZZZ) I have a problem / question not listed here. What should I do?
All known issues are either fixed or listed above but ofc it can happen that you find something which is not listed here and you want to report it.
The very first thing you have to do is:
Open TWRP
Choose the Wipe menu
Choose FORMAT DATA (not a factory reset!)
Test if your problem is gone
ATTENTION:
This will completely clean your internal storage - all pictures etc everything will be lost so ensure you have a backup!
HINT: TWRP will not save your internal storage in a backup (read here why) so you have to take care otherwise!

UsU background
UsU explained (in short words)
This is just for those want to understand what UsU is in detail and how it works.
If you are not interested in background information.. well its worth to read anyways
rawres_UsU.img -> raw_resources partition
when to be flashed:
once (part of the unlock ZIP), after flashing another raw_resources partition
what it is:
Contains logo for boot, download mode and recovery loading
laf_UsU.img -> laf partition
when to be flashed:
once (part of the unlock ZIP), after flashing another laf partition
what it is:
The laf partition holds your download mode. This one is optimized for UsU and SALT.
aboot_UsU.img -> aboot partition
when to be flashed:
once (part of the unlock ZIP), after flashing another aboot partition (which should NEVER happen as it would hard brick your phone)
what it is:
The debug/engineering/whatever aboot partition and the heart of UsU. The aboot partition is part of your bootloader stack and besides this it also holds the fastboot mode.
Its a leaked file originally coming from Mohd Saqib (see credits in the OP) who may even don't know what he provided in his unbrick guide.
Most important: If you ever flash a KDZ/TOT with one of the windows tools out there it will overwrite this partition and HARD-BRICK your device.
That's why I write this so explicit in the LIMITATIONS/KNOWN ISSUES topic of the OP!
For more details refer to the above FAQ #27!
<model>_UsU_baseband_flash-in-twrp.zip
when to be flashed:
once, after flashing another modem partition (e.g. H-ROM still containing the modem partition! which is incredible bad practice btw)
what it is:
model dependent baseband / radio / modem files (the stuff needed to make your cell service work).
I extracted for every model these files and provided a flashable ZIP as this ensures the modem will not crash when on MM or N firmwares.
To be specific these files are always the latest LP basebands I was able to find/extract for each model and yes its still a kind of hackish this way.
If I will be able to get the kernel module working this file will be obsolete on newer ROMs but will be necessary on all which do not have that kernel patch.

Thank you man! I've been waiting for this since last July! Will try it as soon as I get home

Thank you.
I`ve been USU`d!
9TP968739A2116456

I think I will take a 1 year vacation now...
.

Congrats
You worked very hard over the last year.

Glorious
Even though I own an h815 I want to thank you for your work. This is truly glorious and truly impressive!

steadfasterX said:
I think I will take a 1 year vacation now...
.
Click to expand...
Click to collapse
Hahah You deserve more than 1 year I'm so excited to try it as soon as possible. Downloading necessarily files right now. Thank you again !

Im not clear how you flash twrp. Do you use lglaf? adb? Please tell me

Congrats steadfaster!!!! Does anyone know if there are any working roms for VS986 yet?

TheLatios381 said:
Im not clear how you flash twrp. Do you use lglaf? adb? Please tell me
Click to expand...
Click to collapse
pls do not try to unlock bc the very first thing is it requires carefully reading.
I do not flash TWRP but you would when you follow the guide.
How? Its all described. Read or do not go further.
.

I finished the unlock processes but now i cannot connect to the mobile network on VS986. Tried to set up the APN settings but not working. I'm on stock 13B Lollipop rom.
Edit: Figured it out. Had to do the modem flash from FAQ: 5c) I flashed UsU and now Android crashes with a blue/purple demigod screen

I followed the instructions. It worked. I'm using lineageOS on my h812!!! Thanks steadfasterX.

I installed RR 7.1.2 (H811 ver) on my h812 but there are a few issues popping up, like sound not working, youtube videos barely able to play, and sensors not working. Is anyone else experiencing these issues?

How would I go about telling if a ROM has a bootloader stack in it? I am slightly confused. Which versions would cause problems? Is it just v29a? Or are there more that cause problems?
I have read the limitations 6 times and I don't understand.

LS991 roms
Are the H815 roms supposed to be in the LS991 Lineage 13 folder?

Lg g4 h812
For the H812, witch model should I take, H811 or H815?

TheLatios381 said:
I installed RR 7.1.2 (H811 ver) on my h812 but there are a few issues popping up, like sound not working and youtube videos barely playing, is anyone else experiencing these issues?
Click to expand...
Click to collapse
When sound is not working its very likely a modem partition issue. Read the FAQ regarding bootloop and flash the modem partition of your device
adam_s_459_ said:
How would I go about telling if a ROM has a bootloader stack in it? I am slightly confused. Which versions would cause problems? Is it just v29a? Or are there more that cause problems?
I have read the limitations 6 times and I don't understand.
Click to expand...
Click to collapse
A custom ROM will never include a bootloader stack unless it is a stock ROM. Like the v29a.
If you open the ROM zip and you find a file named aboot do not flash it.
Custom ROMs like aoscp or LOS will never contain the bootloader stack.
TheDerpyLlamas said:
Are the H815 roms supposed to be in the LS991 Lineage 13 folder?
Click to expand...
Click to collapse
Ah good one I have to remove that folder.
And regarding your question read FAQ 12
TJtheBLueDragon said:
For the H812, witch model should I take, H811 or H815?
Click to expand...
Click to collapse
read FAQ 12
Sent from my LG-H815 using XDA Labs

Since my H810 isn't my daily driver any more and after following this thread for a looong time I decided to take the plung and unlock. Salt said "Some parts of UsU couldn't be flashed!" and continued but when that was done I was unable to boot into fastboot mode. From there things mostly failed. I do have a full salt backup from a few days ago. Right now the phone won't boot into either download or fastboot mode. Happy be be a guinea pig. Logs below:
https://bpaste.net/show/6028668ee3a1

Red Magic 5G Bootloader Unlock Guide: OR get ROOT & TWRP without unlocking the BL!!!

Red Magic 5G Bootloader Unlock Guide: OR get ROOT & TWRP without unlocking the BL!!!
***Bootloader Unlock Instructions for the Nubia Redmagic 5G + installing TWRP:***
WARNING: ANY BOOTLOADER UNLOCK METHOD INVOLVES THE RISK OF BRICKING YOUR DEVICE PERMANENTLY. WHILE THERE IS USUALLY A WAY TO RECOVER, DO NOT ATTEMPT THIS PROCEDURE IF YOU DO NOT KNOW WHAT YOU ARE DOING. BAD THINGS CAN HAPPEN. YOU HAVE BEEN WARNED!!! YOU MAY BE LEFT WITH A USELESS BRICK!!! READ ALL FURTHER WARNINGS EXPERIMENTAL METHOD IN ORIGINAL DOWNLOAD FILE WORKS, I'M USING IT
If you want a NOOB guide look at this post: https://forum.xda-developers.com/nu...beginner-tutorial-unlock-bootloader-t4131585/
Also note a user has managed to fix the FP sensor post BL unlock, see this post here: https://forum.xda-developers.com/nu.../guide-calibration-finger-print-loss-t4132961
Still, I suggest root bypass it's better.
MegaNZ Link for Root without unlocking the Bootloader, and without breaking the FP, also includes instructions for installing BlackMagic5G (explanation below), adding HD VOLTE, how to restore from a brick, and some other cool tricks: https://mega.nz/file/igphSCTD#OybJo9t1zwvJ0bdbAcN2BCqxWXAfHdhk3JFB4_5xkVc
I suggest you flash my BlackMagic5G and don't unlock your bootloader at all - just root. It's CN 2.52 ROM based. You'll get VOLTE, , GApps installed, Rooted with Magisk, TWRP, debloated, YouTube Vanced, AdAway, SmartPack Kernel Manager, etc. - looks like the Global / NA variant of the ROM. Almost perfect except still uses Messages and Phone from Nubia. Plus you will enable Face Unlock not available in the Global or NA versions of the ROM, and FP will still work! Click on the Google Search bar widget and the mic icon takes you to the Google Assistant, the left icon is Google Feed, type in the middle bar for a Google Search. Has 1Weather Free weather widget that looks great, and Google Calendar widget for your whole month of activities. Translate, Lens, Chrome, all the Google Apps are there. And the Chinese Nubia apps are nearly all GONE!
MegaNZ Link for BlackMagic5G Beta - IT'S ONLY THE DATA PARTITION + ROOTED KERNEL + NA SPLASH SCREEN, you NEED to 1) install the Red Magic 2.52 ROM below FIRST 2) Root using the first link posted above 3) Flash restore this from TWRP: https://mega.nz/file/r9hF2BwS#RrAXiFWSBNX8dLqfrH8nNHo_uigPC8uYXonwhALhGbo
MegaNZ Link for the Red Magic 5G CN 2.52 ROM: https://mega.nz/file/aoxBFAqY#EDt2OZBGTME4ZGKnERKpK_t-aJT_rWgD0aqBFkilRcY
*** NOW THE BOOTLOADER UNLOCK INSTRUCTIONS ***
Go to Settings / About phone / Build Number (NX659_J_ENCommon_V3.08 on North American Variant), click 7 times, Now you are a developer message appears, go back a menu to Settings / Other system settings / Developer options.
Enable:
OEM unlocking "Allow the bootloader to be unlocked"
USB debugging "Debug mode when USB is connected"
Install Minimal ADB and Fastboot (Windows 10 in this example): https://www.androidfilehost.com/?fid=746010030569952951
Default install path is:
C:\Program Files (x86)\Minimal ADB and Fastboot\
Go to the Search button on the bottom on Windows 10, type cmd, Command Prompt will appear in the menu. Right click it and Run as Administrator. All commands to be typed will be run in this Command Prompt window (referred to as terminal) unless otherwise stated to run on the phone.
Now Terminal window appears (it says Administrator: Command Prompt in the heading):
Text displayed is:
Microsoft Windows
(c) 2020 Microsoft Corporation. All rights reserved.
C:\WINDOWS\system32>
Typed in terminal:
cd "c:\Program Files (x86)\Minimal ADB and Fastboot"
I now connected the phone to a USB port on the PC.
On the phone, a Window appeared:
"Allow USB debugging?"
The computer's RSA key fingerprint is:
[36 digit code] Example:
C8:A17:E2:01:F6:A1
:368:10:E8:33:20:FB:
93:7D
Always allow from this computer (it's my computer so I clicked it since I trust the computer)
CANCEL / ALLOW (I clicked ALLOW)
Typed in terminal:
adb reboot bootloader
The phone reboots. Once the phone screen boots, in the center it says: Now you are in fastboot mode.
From the terminal I typed:
fastboot oem nubia_unlock NUBIA_NX659J
The terminal now displayed:
...
(bootloader) START update nubia fastboot unlock flag!!!
(bootloader) START set state to 1 ok!!!
In the terminal I typed:
fastboot flashing unlock *** DO NOT TYPE THIS IF YOU WANT TO KEEP A WORKING FP!!! READ TOP OF POST!!! AVOID THIS WITH THE EXPERIMENTAL METHOD OF ROOT WITH NO BL UNLOCK ***
Now a screen appeared on the phone with a big <!> red icon in the left corner. The rest in white text is a warning message. "By unlocking the bootloader, you will be able to install custom operating system on this phone. A custom OS is not subject to the same level of testing as the original OS, and can cause your phone and installed applications to stop working properly-
Software integrity cannot be guaranteed with a custom OS, so any data stored on the phone while the bootloader is unlocked may be at risk.
To prevent unauthorized access to your personal data, unlocking the bootloader will also delete all personal data on your phone.
Press the Volume keys to select whether to unlock the bootloader, then the Power Button to continue."
I selected UNLOCK BOOTLOADER and my device was completely erased. The factory OS loaded then. This process takes some time to complete.
Now the device rebooted with a warning message, and a big <!> yellow icon in the left corner.
"The boot loader is unlocked and software integrity cannot be guaranteed. Any data stored on the device may be available to attackers. Do not store any sensitive data on the device.
Visit this link on another device:
g.co/ABH"
Now the device reloads the firmware apparently and wipes all user data. Upon setting up the phone, the fingerprint display registration comes up and asked to place my finger on the back of the phone. There is no fingerprint sensor on the back of the Redmagic 5G! It is under the screen! So this step must be skipped. The ROM setup is corrupt or incomplete, a beta possibly. I setup the phone then went into Settings / Security to try to add a fingerprint. The button to add fingerprint then appears. Once I click the button, I get this error:
Loss of fingerprint calibration data
Loss of fingerprint calibration data was detected.
Currently unable to complete fingerprint entry,
please contact Nuia after-sales service via
4007006600
See the XDA post for recalibrating the FP: https://forum.xda-developers.com/nu.../guide-calibration-finger-print-loss-t4132961
ROOT FOR ALL DEVICES:
(These files are included in the tools download zip, Magisk 20.4 and MagiskManager-v7.5.1.apk, but this is the official source as updates post): Go to XDA and Download Magisk Manager and install the APK. Download the latest Magisk as well from the Manager. You can then reboot to Recovery (volume up + power, release the power button once the screen shows it loading, hold the volume up down until you see TWRP pop up). Flash Magisk from TWRP Install / Zip / sdcard / Magisk.zip reboot and you'll have root.
BL unlock first method was tested on North American variant and it works. But it breaks your FP sensor and gives you an annoying boot prompt.
If at any time you want to remove the OEM Bootloader unlock, you plug into the PC, go to the terminal for Minimal ADB and Fastboot, type:
adb reboot fastboot
fastboot oem nubia_unlock NUBIA_NX659J
fastboot flashing lock (screen will prompt to relock BL, choose to Relock)
The phone should reboot and install the original software. BUT...
If it says you are corrupted well, you have more issues.
You'll have to reflash the stock recovery.img, reboot to stock recovery, wipe data, wipe cache, and flash the CN update.zip rom to a flash drive FORMATTED TO FAT32 (annoying as hell) But you NEED a USB-C to OTG Adapter to attach a Flash Drive / SDCARD this way). If you don't have one, you better reflash TWRP using the prior instructions and flash the update.zip from there. Install, select the update.zip, flash. Wipe Data, Cache, ART/Dalvik. Reboot.
Now it should WIPE the entire phone and be back to normal Android 10 setup non rooted, no unlocked bootloader. Always beware of data loss doing root functions!!! Always be prepared to setup your phone entirely over again. Google Backup is very good to turn on before you do any of this stuff if you have already installed apps.
*** WARNING - THIS BYPASS METHOD COULD GO AWAY AT ANYTIME. IT SHOULD EVENTUALLY BE FIXED BY NUBIA ***

mslezak said:
{Mod edit}
***Bootloader Unlock Instructions for the Nubia Redmagic 5G + installing TWRP:***
Settings / About phone / Build # click 7 times, now your a dev message appears, good back a menu, go to Additional Settings / Developer Options
Enable:
ADB debugging, + OEM unlock
Connect phone to PC, approve device on phone RSA key for USB debugging
From Minimal ADB and Fastboot:
adb reboot bootlader
fastboot oem nubia_unlock NUBIA_NX659J
fastboot flashing unlock
(approve on phone with volume keys to unlock and hit the power button, now you'll get an annoyng mesage on boot as insecure unlocked BL) *ALL YOUR DATA WILL BE WIPED*
Next:
fastboot flash recovery recovery-TWRP-3.4.1B-0324-NUBIA_REDMAGIC_5G-CN-wzsx150.img
fastboot reboot recovery
Enter TWRP, set to not be removed by updates if prompted.
Boot up the device, setup as a new device. You're on stock ROM / kernel now unlocked.
Once you get up and running you'll want APK Mirror app to install stuff on the China Variant it's in the Nubia Playstore. Gboard download as well and set as default it's a lot easier than the Chinese keyboard that swaps between Chinese and English. Set size extra tall for this huge phone (I prefer anyhow). Chrome go download it from APK Mirror app as well. Then go to XDA and Download Magisk Manager and download it and install the APK. Download the latest Magisk as well from the Manager. You can then reboot to Recovery (volume up + power). Flash Magisk from TWRP reboot and you'll have root.
Note on my testing the fingerprint did not work after unlocking the bootloader. It says to contact Nubia support at some odd number. Hopefully they fix this.
Click to expand...
Click to collapse
You were able to actually install TWRP? Not just boot it? I thought A10 devices cant have twrp permanently installed?

That is a very good question my friend. I had to reflash it several times while rooting so it appears you are correct.
Now a window when I FIRST installed popped up and said make Recovery read only so a system update. can't overwrite it, to this I didn't even pay attention. So assuming that question does lock down recovery, it should stick.

mslezak said:
That is a very good question my friend. I had to reflash it several times while rooting so it appears you are correct.
Now a window when I FIRST installed popped up and said make Recovery read only so a system update. can't overwrite it, to this I didn't even pay attention. So assuming that question does lock down recovery, it should stick.
Click to expand...
Click to collapse
So its not permanent? Thats what I thought.

Well it could be permanent...
VZTech said:
So its not permanent? Thats what I thought.
Click to expand...
Click to collapse
What I was trying to say is that I've never had a phone where I had to select "prevent recovery from being overwritten" so I just clicked off the message. Had I selected "keep TWRP from being overwritten" then possibly it sticks. It's just a matter of making the recovery partition READ ONLY.

mslezak said:
What I was trying to say is that I've never had a phone where I had to select "prevent recovery from being overwritten" so I just clicked off the message. Had I selected "keep TWRP from being overwritten" then possibly it sticks. It's just a matter of making the recovery partition READ ONLY.
Click to expand...
Click to collapse
The issue with that could be any future updates though. Rm uses there own recovery for that. They don't provide fastboot images either I believe

Can anyone send me backup of the super partition?
I accidentally flashed an image to the super partition with twrp thinking it was the system partition (it technically is tho) and it bricked my phone and messed up twrp.
Only stock recovery works but the stock recovery cannot fix it by installing a full ota from a otg drive.
I do have a backup on my phone but it is inaccessable.
Could anyone please send me a backup of the super partition or have any idea on how to fix this?
(I tried to use edl and backup my data to recover my backup of the super partition but it seemed like it needed a programmer binary from qualcomm)

Future updates...
VZTech said:
The issue with that could be any future updates though. Rm uses there own recovery for that. They don't provide fastboot images either I believe
Click to expand...
Click to collapse
Yes what I've been told by prior Redmagic Users 3 and 3S is the ROM is released, as long as your boot.img is not patched with Magisk, it can be installed through the menus in Settings / About Phone / Update or someplace like that. You just download the ROM to the appropriate folder on the phone.
So far I have 1 link to a China ROM update here: https://ui.nubia.cn/rom/detail/65
Now on how to install the ROM, I use the Chrome browser set to autotranslate webpages. Most of the Chinese will be translated from here: https://bbs.nubia.com//thread-1136030-1-1.html
Basically it's going to wipe your device clean, and you can use a Nubia backup tool which will save all your items to a folder. Which then you should copy to your PC before installing the new ROM. Then it gives you instructions to get that data back onto your updated device.

apersomany said:
I accidentally flashed an image to the super partition with twrp thinking it was the system partition (it technically is tho) and it bricked my phone and messed up twrp.
Only stock recovery works but the stock recovery cannot fix it by installing a full ota from a otg drive.
I do have a backup on my phone but it is inaccessable.
Could anyone please send me a backup of the super partition or have any idea on how to fix this?
(I tried to use edl and backup my data to recover my backup of the super partition but it seemed like it needed a programmer binary from qualcomm)
Click to expand...
Click to collapse
Your probably screwed. I had this issue on a rm3s. You will need an unbrick tool. It was released for the rm3s about 4 mos after release. NUBIA should have true fastboot images available for download, but they dont.

VZTech said:
Your probably screwed. I had this issue on a rm3s. You will need an unbrick tool. It was released for the rm3s about 4 mos after release. NUBIA should have true fastboot images available for download, but they dont.
Click to expand...
Click to collapse
That's because of the super (dynamic) partition, see from the latest (and only) ROM:
Excerpt of the ROM installation script where it delineates the dynamic vs non dynamic partitions - you have product w/ a file transfer list, then vendor, system, and odm, The other files (boot.img, dtbo.img, splash.img, etc. and other various files) should be flashable with fastboot.
# Update dynamic partition metadata
assert(update_dynamic_partitions(package_extract_file("dynamic_partitions_op_list")));
unmap_partition("product");
block_image_update(map_partition("product"), package_extract_file("product.transfer.list"), "product.new.dat.br", "product.patch.dat");
unmap_partition("vendor");
block_image_update(map_partition("vendor"), package_extract_file("vendor.transfer.list"), "vendor.new.dat.br", "vendor.patch.dat");
unmap_partition("system");
block_image_update(map_partition("system"), package_extract_file("system.transfer.list"), "system.new.dat.br", "system.patch.dat");
unmap_partition("odm");
block_image_update(map_partition("odm"), package_extract_file("odm.transfer.list"), "odm.new.dat.br", "odm.patch.dat");
# --- End patching dynamic partitions ---

apersomany said:
I accidentally flashed an image to the super partition with twrp thinking it was the system partition (it technically is tho) and it bricked my phone and messed up twrp.
Only stock recovery works but the stock recovery cannot fix it by installing a full ota from a otg drive.
I do have a backup on my phone but it is inaccessable.
Could anyone please send me a backup of the super partition or have any idea on how to fix this?
(I tried to use edl and backup my data to recover my backup of the super partition but it seemed like it needed a programmer binary from qualcomm)
Click to expand...
Click to collapse
You should be able to flash the latest ROM via EDL mode if you've ever used EDL mode before, it usually requires shorting pins together in the device, although some recoveries will let you just boot into EDL mode if the phone still boots. It will be detected. Although on this device with the dynamic partition, I don't know how you would flash these in EDL mode... dynamic partitions - you have product w/ a file transfer list, then vendor, system, and odm that do not look like fastboot flashable parts. Possibly the unbrick tool for Redmagic 3/3S could be modified to do this for you.

mslezak said:
That's because of the super (dynamic) partition, see from the latest (and only) ROM:
Excerpt of the ROM installation script where it delineates the dynamic vs non dynamic partitions - you have product w/ a file transfer list, then vendor, system, and odm, The other files (boot.img, dtbo.img, splash.img, etc. and other various files) should be flashable with fastboot.
# Update dynamic partition metadata
assert(update_dynamic_partitions(package_extract_file("dynamic_partitions_op_list")));
unmap_partition("product");
block_image_update(map_partition("product"), package_extract_file("product.transfer.list"), "product.new.dat.br", "product.patch.dat");
unmap_partition("vendor");
block_image_update(map_partition("vendor"), package_extract_file("vendor.transfer.list"), "vendor.new.dat.br", "vendor.patch.dat");
unmap_partition("system");
block_image_update(map_partition("system"), package_extract_file("system.transfer.list"), "system.new.dat.br", "system.patch.dat");
unmap_partition("odm");
block_image_update(map_partition("odm"), package_extract_file("odm.transfer.list"), "odm.new.dat.br", "odm.patch.dat");
# --- End patching dynamic partitions ---
Click to expand...
Click to collapse
Yes those .img files can easily be fastboot flashed. Unfortunately it wont solve his problem. He needs the nubia unbrick tool, which is tough to get. I dont understand why Nubia makes things difficult. They should provide proper Fastboot files.

I already tried edl (not to flash, but to recover my backup of the super partition) but it seems like it needed a firehose binary. I still can use bootloader, fastbootd, recovery. It's just that the recovery fails at assert dynamic partition update thing with a error 7 (probably because my super partition turned into a normal partiton). I tried to flash a super empty image made with lpmake and try flashing the ota but that didn't work. I think if someone gives me a backup of the super partition I could flash that and that could work. I also had an idea of flashing a super partition of another devices factory image to make my super partition a dynamic partition, but I couldn't find any online.

apersomany said:
I already tried edl (not to flash, but to recover my backup of the super partition) but it seems like it needed a firehose binary. I still can use bootloader, fastbootd, recovery. It's just that the recovery fails at assert dynamic partition update thing with a error 7 (probably because my super partition turned into a normal partiton). I tried to flash a super empty image made with lpmake and try flashing the ota but that didn't work. I think if someone gives me a backup of the super partition I could flash that and that could work. I also had an idea of flashing a super partition of another devices factory image to make my super partition a dynamic partition, but I couldn't find any online.
Click to expand...
Click to collapse
I get a Global Device on Monday. I'll try to use Qualcomm tools to make a brick restore image of Global. If I get one made I'll post all the tools to restore the device on Mega.nz. Because of the super partition it has to be done this way. Not via TWRP as you know. I'm working on Dev tools for this device as fast as possible.

mslezak said:
I get a Global Device on Monday. I'll try to use Qualcomm tools to make a brick restore image of Global. If I get one made I'll post all the tools to restore the device on Mega.nz. Because of the super partition it has to be done this way. Not via TWRP as you know. I'm working on Dev tools for this device as fast as possible.
Click to expand...
Click to collapse
Thank you so much!

Okay I can't add anything special but daaamn this community is amazing. So much help I love you all

To relock BL repeat the instructions with 1 different command
Just replace
fastboot flashing unlock
with
fastboot flashing lock
Again you approve to lock on the phone prompt with the volume keys and your phone will be wiped and all will be back to normal, you'll be locked. And back to phone setup.
I'd edit the original post but the moderators took away my rights!!! Because I posted a Telegram link WHY - how do you expect development to get better???
BTW anyone with a NEW phone arriving that can record the FP failures and all errors please contact me so I can send to Nubia. They are waiting for me to reproduce the error but I already setup my new phone... Thinking I wouldn't be the ONLY ONE to contact [email protected] ... Guys you want developer support on this phone or not. Contribute please.
mslezak said:
{Mod edit}
***Bootloader Unlock Instructions for the Nubia Redmagic 5G + installing TWRP:***
Settings / About phone / Build # click 7 times, now your a dev message appears, good back a menu, go to Additional Settings / Developer Options
Enable:
ADB debugging, + OEM unlock
Connect phone to PC, approve device on phone RSA key for USB debugging
From Minimal ADB and Fastboot:
adb reboot bootlader
fastboot oem nubia_unlock NUBIA_NX659J
fastboot flashing unlock
(approve on phone with volume keys to unlock and hit the power button, now you'll get an annoyng mesage on boot as insecure unlocked BL) *ALL YOUR DATA WILL BE WIPED*
Next:
fastboot flash recovery recovery-TWRP-3.4.1B-0324-NUBIA_REDMAGIC_5G-CN-wzsx150.img
fastboot reboot recovery
Enter TWRP, set to not be removed by updates if prompted.
Boot up the device, setup as a new device. You're on stock ROM / kernel now unlocked.
Once you get up and running you'll want APK Mirror app to install stuff on the China Variant it's in the Nubia Playstore. Gboard download as well and set as default it's a lot easier than the Chinese keyboard that swaps between Chinese and English. Set size extra tall for this huge phone (I prefer anyhow). Chrome go download it from APK Mirror app as well. Then go to XDA and Download Magisk Manager and download it and install the APK. Download the latest Magisk as well from the Manager. You can then reboot to Recovery (volume up + power). Flash Magisk from TWRP reboot and you'll have root.
Note on my testing the fingerprint did not work after unlocking the bootloader. It says to contact Nubia support at some odd number. Hopefully they fix this.
Click to expand...
Click to collapse

Just in case if somebody need a Chinese version of official ROM v2.46 for RedMagic 5G.
Code:
https://mega.nz/file/vc0DiabR#npahTop-JXZ9Mwv-lA7G6DxTG2qqOOAf6AwW8NdEEKw

mslezak said:
Just replace
fastboot flashing unlock
with
fastboot flashing lock
Again you approve to lock on the phone prompt with the volume keys and your phone will be wiped and all will be back to normal, you'll be locked. And back to phone setup.
I'd edit the original post but the moderators took away my rights!!! Because I posted a Telegram link WHY - how do you expect development to get better???
BTW anyone with a NEW phone arriving that can record the FP failures and all errors please contact me so I can send to Nubia. They are waiting for me to reproduce the error but I already setup my new phone... Thinking I wouldn't be the ONLY ONE to contact [email protected] ... Guys you want developer support on this phone or not. Contribute please.
Click to expand...
Click to collapse
we found out that using the cn rom it all works without even unlocking the bootloader, even while oem unlock was disabled in dev options but there is some kind of vbmeta img required. a full guide is incoming.

VZTech said:
The issue with that could be any future updates though. Rm uses there own recovery for that. They don't provide fastboot images either I believe
Click to expand...
Click to collapse
You can flash their NX659J-update.zip files directly from TWRP that's how we restored our bricked devices already. So OTA updates no, but you can download them anyway and flash from TWRP directly. Yes we have to figure out a concrete restore method which isn't 100% working yet. I.e. all your data is lost this way apparently AT THIS MOMENT... MORE TO COME.