Related
*** Simplified Guide for: Unlocking Bootloader + Rooting/BusyBox/Custom Recovery + Radio/LG Inverted Logo/Inverted Screen/Wonky Touch Screen
Patch + CyanogenMod 11 Firmware ***
*ONLY FOR*: Metro PCS LG Optimus L9 P769 ( MS769 )
Guide updated: Saturday, October 18th, 2014
THIS GUIDE IS SPLIT INTO TWO POSTS, THE FIRST HALF OF THE GUIDE IS THIS POST, POST #1, THE SECOND HALF OF THE GUIDE IS POST #2
=== INTRODUCTION
First off let me just say that I did not find these vulnerabilities or write these exploits. The tutorial that I have written here for this device is a very simplified, decomplicated version of several complicated guides for the LG P769 Device all combined into one, easy to read, simple guide. This guide explains the mechanics behind every step so you will know exactly what is going on and why we're able to do this.
I wrote this guide in a deliberately redundant manner so that the reader will be able to easily accomplish unlocking the bootloader for this device. Although this guide may seem to be very long it is in fact written that way so that you can follow every step very easily.
You should understand first that within the LG Optimus L9 series of phones there are multiple submodels, those being the P760, P765, P769 and the MS769. The MS769 is the Metro PCS version that was manufactured by LG to be sold by and used on the Metro PCS Network, however, the MS769 is the EXACT SAME THING as the P769 which was manufactured by LG to be sold by and used on the T-Mobile Network. So it stands to reason that if you have a T-Mobile P769 this guide will also help you unlock your bootloader as long as it was manufactured before T-Mobile requested LG to encrypt the bootloader. Based on all of my research any MS769 or P769 manufactured on or before August, 2013 does NOT have an encrypted bootloader and CAN be unlocked. You may become very frustrated while doing this, but DO NOT GIVE UP because this guide will get the job done.
This guide will get your Bootloader unlocked, SIM Card Slot unlocked and get CyanogenMod 11 KitKat 4.4.4 installed. The greatest thing about having an unlocked bootloader is the fact that you will always have the option to get the LATEST Android OS including the new Lollipop 5.0 when it comes out because new releases will always be portable to this device! Read more about all of this below.
There are also links to now inexpensive but high end and premium protection cases and extended batteries so you can get your device pimped and protected.
=== THE PITCH
Now some Q&A and the reasoning behind this:
Why unlock the bootloader?
Why install CyanogenMod ROM/Firmware?
Why have prepaid wireless service with a crappy company like Metro PCS/T-Mobile?
Why this phone?
--- WHY THIS PHONE?
Why this phone?: This phone is CHEAP. I paid $75 bucks for this phone brand new off eBay with free shipping! then I ordered a hard Poly Carbon triple protection case with an additional layer of Corning Gorilla Glass version 2 + A Privacy Screen Protector for $10 bucks.
The hardware specifications for this phone are ****ing awesome for the price. The hardware is almost all open source. The processor is a Texas Instruments OMAP dual core with no backdoors in it and it can be overclocked to greater than 1.3GHz. Heck, Texas Instruments even published the CAD files and source code for this processor!
You can even order an extended battery for $15 bucks off of Amazon which will give your phone over 7 days of continuous use without charging <--- AWESOME! Link to a ZeroLemon 5450 mAh Extended Battery: [ http://www.amazon.com/ZeroLemon®-T-Mobile-MetroPCS-Extended-Protector/dp/B00MATB7XS/ ]
There are even other threads and how-to-do guides for waterproofing your triple protection cases and phone by adding gaskets and sealant around the edges!
To sum it up, by getting this device and investing a little time and about $25 bucks or more you end up with a bad ass smart phone that will be ahead of even the newest stock devices out there, on multiple levels, for years to come. You will also have ultimate freedom and control of it as well as the ability to put it on any Network Carrier.. so not only will it be internationally unlocked, you will have in your hands an epic device for under $100 bucks.
--- BASIC PHONE SPECIFICATIONS FOR MS769
Processor: 1 GHz Clock Dual Core TI OMAP 4430 [ http://www.ti.com/product/omap4430 ] <--- This bad boy can be overclocked to 1.3 GHz stable in CyanogenMod! It can also be overvolted and overwatted!
Memory: 1GB of LPDDR3 Memory at 400 MHz
Internal Memory Storage: Anywhere from 1.8GB to 4GB depending on the model
Expandable Memory Storage: Up to 32GB with an External Micro SDHC Card
Screen: 4.7" QHD with Corning Gorilla Glass version 2
Radio: GSM 850/900/1800/1900, UMTS I/II/IV/V* <--- This means you can use this device on AT&T, T-Mobile, Sprint, Verizon and U.S. Cellular which includes all of the subsidy providers such as: SimpleMobile(AT&T/T-Mobile), MetroPCS(T-Mobile), Boost(Sprint), Verizon, etc..
^^^ ONLY AFTER THE BOOTLOADER IS UNLOCKED AND YOU HAVE INSTALLED CYANOGENMOD AND SOME PROVIDERS OFFER FREQUENCIES OF LOWER TIERS SUCH AS THE UNLIMITED 3G NO CONTRACT AT&T ^^^
^^^ ALL YOU WOULD DO IS THEN UNLOCK THE DEVICE SIM SLOT BY GETTING YOUR DEVICE SIM CARD LOCK CODE AND THEN INSERT ANY CARRIER SIM CARD INTO THE SIM CARD SLOT AND YOU WOULD HAVE SERVICE THROUGH THAT PROVIDER ( SEE THE GUIDE FOR GETTING SIM CARD LOCK CODE ) ^^^
--- WHY HAVE PREPAID WIRELESS SERVICE WITH A CRAPPY COMPANY LIKE METRO PCS/T-MOBILE?
Why have prepaid wireless service with a crappy company like Metro PCS/T-Mobile?: With this device you only need to pay for 1 month of service or maybe they have a daily package? Then you can unlock the bootloader, install other Operating Systems/Firmware and put this phone on any GSM/LTE/EDGE/2g/3g/4g network that operates on the radio frequencies that this cell phone supports.
In other words you're paying like $100 bucks for a sweet middle tier phone that you can then put on almost any network... This includes AT&T, T-Mobile, Boost Mobile, SimpleMobile, Metro PCS and lot more unlisted providers in any country in the world. What's even better is that you don't even need to provide these service providers with any personal information because you're paying in full to be on their network.. That means you never have to be subjected to any of their terms of service or any of their policies when you give them a made up name and pay cash for their service.. and trust me you wouldn't like their policies. I say **** contract services.
--- WHY INSTALL CYANOGENMOD ROM/FIRMWARE?
Why install CyanogenMod ROM/Firmware?: You don't have to, but CyanogenMod ROMs/Firmware is the best publicly available Android Firmware in the entire planet. The security of CyanogenMod is top ****ing notch. After you get this installed you can harden your device to be so ****ing secure it rivals a Boeing Black Phone ( A Neo900 will be better though once it comes out ). With the right hardening, the only thing anyone would be able to do remotely is **** with your radio by sending encrypted packets to your radio.. and it would only work
if there's a mechanism in the hardware code to accept such requests, but again, with the right hardening they will be automatically rejected. And it's not just the remote security provided by CyanogenMod Firmware either, you get absolute freedom and full control over almost every aspect of your phone's hardware, software. You can rip games, music, pictures, videos, movies absolutely anything for free. You can then exploit the service providers in most cases and get truly unlimted 4g LTE network speed without throttling. This means you can use your device as an all in one system on the go! You can use it for unlimited high speed internet with low ping and you can wirelessly tether to your laptop/computer effortlessly. With the right software and additional configurations you will get an excellent ping of <=64 ms. All I have to say is..
FREE AND OPEN SOURCE SOFTWARE FOR LIFE!!!!!
BE SURE TO LOOK FOR MY CYANOGENMOD SECURITY HARDENING TUTORIAL!
--- WHY UNLOCK THE BOOTLOADER?
Why unlock the bootloader?: Because you need to unlock the bootloader on this device in order to do all of the above. This device is especially difficult to unlock but as long as you have a device version that is unlockable and all of the requirements this guide will get the job done.
=== CREDITS AND THANKS
You can thank me for writing this. I'm sure most of you couldn't be bothered with the complicated mess of the other guides.
I would also like to thank Lelus, CMahendra and several others for your exploits. Without your work none of this would be possible for this Android device. Above all else I would love to thank the CyanogenMod Team for CyanogenMod! THE BEST ****ING FIRMWARE IN EXISTENCE!
=== USEFUL INFORMATION FOR THE MS769
--- HOW TO BOOT INTO S/W UPGRADE MODE
Remove battery, plug in USB Cable, Hold UP on the volume rocker + Power button for exactly 1 second then insert the battery.
--- HOW TO DO A HARD RESET ON STOCK ROM
With battery inserted, Hold DOWN on the volume rocker + HOME button and then power up the device with the POWER button.
--- HOW TO ACCESS THE LG HIDDEN MENU ON STOCK ROM
On the Dial Pad, press: 3845#*769# OR 3845*#769# to access the LG Hidden Menu.
=== PREREQUISITES
The methods here are very important and you must follow each step accordingly.
Firstly, if your LG MS769 from Metro PCS was manufactured after July, 2013 ( AND POSSIBLY UP TO August, 2013 ) you will *NOT* be able to
unlock the bootloader ( as far as I know, and as of the date of me writing this ),
because Metro PCS/T-Mobile and other providers requested LG to encrypt the bootloader for this device after they found out folks were hacking the bootloader and loading other Firmware and Operating Systems. So you will have to have a version which was manufactured before
July, 2013. You can find out what device you have by looking at the sticker on the housing of your device underneath the battery. Just
remove the back cover, then remove the battery and you will see the sticker with your device information.
If you have one of the unlockable versions continue reading.
Secondly, you absolutely have to be running either Microsoft Windows XP Service Pack 2 or 3, Microsoft Windows Vista or Microsoft Windows 7, have a password on the built in Administrator account that you KNOW and have DOTNET 3.5 installed and updated VCRedist Packages which are:
* VCREDIST 2005 x86
* VCREDIST 2005 x64 <-- Only if your OS is 64 bit
* VCREDIST 2008 x86
* VCREDIST 2008 x64 <-- Only if your OS is 64 bit
* VCREDIST 2010 x86
* VCREDIST 2010 x64 <-- Only if your OS is 64 bit
* VCREDIST 2012 x86
* VCREDIST 2012 x64 <-- Only if your OS is 64 bit
* VCREDIST 2013 x86
* VCREDIST 2013 x64 <-- Only if your OS is 64 bit
You will need both x86 and x64 versions if your Operating System is 64 bit. If your Operating System is 32 bit with a x86 Processor you will not need the x64 versions of the VCREDIST packages.
^^^ ALL OF THESE FILES ARE INCLUDED IN THE ZIP PACKAGE BELOW ^^^
You *cannot* use Microsoft Windows 8 to complete this tutorial because it just won't work ( I couldn't get it to anyway ), there are too many compatibility issues with the software in this guide to get it done. Sorry Linux users! Linux doesn't work either so don't even try it with WINE. This also will not work in a virtual machine. If you have an extra laptop/PC laying around I'd suggest you go and download Microsoft Windows Vista or Microsoft Windows 7. You can get these for free now off TechNet if you still have a TechNet account, or maybe an installation disc if you have one, or you could just download it for free from TPB. I can't post links to TPB here in this forum, but just go check around, actually it's not illegal to download if you don't crack the OS, you're just evaluating it so that you can complete this guide and then reinstall your regular OS.
Also be sure to enable the: *View Files with known File Extensions* option within the *Folder* options in your Microsoft Windows Control Panel Options, and also enable the *View Hidden Files and Folders* Option.
=== MORE PREREQUISITES
* Activated Metro PCS LG Optimus L9 MS769 with Battery <-- Must be activated with an active mobile data connection to unlock bootloader later.
* Metro PCS Sim Card
* External SD Card <-- YOU ABSOLUTELY NEED ONE OF THESE AT LEAST 2GB IN SIZE
* USB Adapter Cable for MS769
Within this guide you will see a link to a .zip file which is hosted on Mega ( formerly MegaUpload ). This .zip file is around 2GB in size.
The .zip file is a package and this package has everything that you will need to complete this guide.
Start now by downloading this package at this link: [ https://mega.co.nz/#!9xBgQQgS!kR14urR1Gd3w_cu8mHbwIQ8urFfiA5bIpgaGgZ-2PPg ]
Now unzip the .zip package that you just downloaded.
This package is very organized.
Within this package that you just unzipped there will be directories named:
* LG L9 - P769\Device SDCard Packages
* LG L9 - P769\Lelus' Tools
* LG L9 - P769\LG Device Firmware Packs
* LG L9 - P769\LG Device USB Drivers
* LG L9 - P769\LG Firmware Utilities
* LG L9 - P769\SHTTPS
* LG L9 - P769\Microsoft Windows Additions
* Guide.txt
Before this first step you need to find out what version of Android that your device is running, on your device, go to Settings->About Phone->Software Information and take note of what version of Android is installed on your device, whether it be JellyBean or Ice Cream
Sandwich. Now go ahead and do a full System Reset from Settings->Backup and Restore->System Reset. Your device needs to be reset to factory settings and all apps removed before we begin.
Let's get started!
Go to post #2
---------------------------------------------------
=== SETTING UP
*** STEP 1: Open the folder/directory named: *Device SDCard Packages*, plug your MS769 Device into your computer, select *Storage Mode* on your MS769, now copy all of the folders within this directory to a new folder in the root of your device external SD Card storage and name the folder: *TOOLS*.
So it should look like this on your SD Card:
* External SD Card\TOOLS\APKs
* External SD Card\TOOLS\CyanogenMod
* External SD Card\TOOLS\Firmware Patches
* External SD Card\TOOLS\gApps
* External SD Card\TOOLS\RAW Files
* External SD Card\TOOLS\Recovery Images
Assuming that you have a fresh installation of Microsoft Windows XP/Vista/7
*** STEP 2: Open the folder/directory named: *LG Device USB Drivers* and install the executable named: *LGUnitedMobileDriver_S4981MAN38AP22_ML_WHQL_Ver_3.8.1* and also the executable named: *LGPCSuite_Setup.exe*
*** STEP 3: Open the folder/directory named: *Lelus' Tools*, copy whichever folder is your Android version. If you have JellyBean installed on your Android device, copy the folder named: *JellyBean*; if you have Ice Cream Sandwich installed on your device, copy the folder named: *Ice Cream Sandwich*.
Now Open the C:\ partition on your Microsoft Windows Installation and paste the folder that you copied here and then rename the folder to: *Lelus*
*** STEP 4: Disconnect your device from the USB Cable and go to Settings and enable Developer USB Mode and enable Allow Installing Applications from Unknown Sources, now for the USB Mode select: *LG Software Utility* and reconnect your device back into your computer.
Now open a Command Prompt as an administrator and type the command: *cd C:\Lelus* <--- without the asterisk characters. Then type the command: *rootL9.bat* <--- without the asterisk characters. The command prompt window will show that it is starting adb on a network port and then it will exploit your Android and root it, after that the command prompt window will show that it is sending the SuperUser and BusyBox packages to your device, then your device will reboot.
After your device reboots, navigate to the File Manager application on your device and then navigate to: *External SD Card\TOOLS\APKs\* and then select the APK package that is named: *L9RecoveryInstaller_1.5.0.apk* and install it. Open the L9 Recovery Installer Application that you just installed and press the option to install recovery, then press the option for CWM/TWRP, and then press the option to reboot into recovery.
After you have rebooted into Clock Work Mod Recovery make a backup of your stock ROM, then reboot back into your ROM and transfer that backup to your computer.
***** DO NOT TRY TO INSTALL ANY ROMS AT THIS POINT! YOUR BOOTLOADER IS STILL LOCKED AND YOU WILL BRICK YOUR DEVICE IF YOU TRY*****
*** STEP 4.5: Open the Start Menu on Microsoft Windows, in the search bar on the bottom type: *Notepad* <--- without the asterisk characters, right click Notepad and select: *Run as administrator*, select the administrator account and type in your password if required, now open the HOSTS file located at: *C:\Windows\System32\drivers\etc\HOSTS* <-- the HOSTS file does not have a file extension, so it won't show up in this window until you select the: *Show All Files* option here.
With the HOSTS file opened in Notepad go ahead and add these lines right below the comment character ( comment characters are a # symbol ):
127.0.0.1 csmg.lgmobile.com
127.0.0.1 csmgdl.lgmobile.com
Save it and proceed to the next step.
*** STEP 5: Copy the folder/directory named: *SHTTPS* that is within the .zip package you downloaded for this guide, open the C:\ partition of your Microsoft Windows Installation and paste the folder you copied. Now open the folder and execute the: *HTTP.exe* file. <--- DO NOT RUN THIS FILE AS AN ADMINISTRATOR, JUST RUN IT NORMALLY. If you are prompted to allow this executable inbound/outbound on the Windows Software Firewall click yes/allow.
=== GETTIN' 'ER DONE
*** STEP 6: Copy the folder/directory named: *LG Firmware Utilities* that is within the .zip package you downloaded for this guide, open the C:\ partition of your Microsoft Windows Installation and paste the folder you copied. Now rename the folder to: *LGTool*, open the folder and execute the executable that is named: *msxml.exe* and wait for this to completely install. Now within this same directory there are 2 other executables which are named: *B2CAppSetup.exe* and *UpTestEX_mod2_marwin.exe*. You will need to right click the first one, select properties then select run compatibility for: *Windows XP Service Pack 2* then click the check box for *Run as Administrator* and click apply, now do the same thing to the second executable which is named: *UpTestEX_mod2_marwin.exe*.
Make sure that your computer is connected to the Internet at this point or this next part will not work. Now execute the executable named: *B2CAppSetup.exe* let it finish loading and when it says no network just close it. Now execute the executable named: *UpTestEX_mod2_marwin.exe* With this window loaded, for the option: *Select Type* you need to select: *3GQCT*, and for the option: *Select KDZ File*, open the file within the package you unzipped ( from the .zip you downloaded from this guide ), The .KDZ file that you need to open is within this folder/directory:
*** LG L9 - P769\LG Device Firmware Packs\Europe\Unlock Bootloader\V20B_00.kdz *** <-- select this .KDZ file for the flash and select the DIAG mode option in the LG KDZ Flash Tool.
Now Click: *Normal Web Upgrade Test* then on the next pop up window click: *Upgrade Start*
*** STEP 6 NOTES: OK THE WAY THIS WORKS IS YOU'RE USING THE SHTTP WEB SERVER AND A MODIFIED WINDOWS HOST FILE TO TRICK THE LG KDZ FLASH TOOL INTO THINKING THAT IT IS CONNECTING TO THE OFFICIAL LG SERVERS TO CHECK FOR AN UPDATE. BY DOING THIS WE ARE ABLE TO FLASH ANY LG KDZ FIRMWARE PACK OFFLINE. YOU MAY OR MAY NOT GET AN APPLICATION CRASH ON THE LG R&D TEST TOOL, IF THE APPLICATION CRASHES JUST CLOSE IT THEN DISCONNECT YOUR DEVICE FROM THE USB CABLE AND RECONNECT, BUT DO NOT REBOOT THE DEVICE OR PULL THE BATTERY. YOUR DEVICE SHOULD DISPLAY A SCREEN THAT SAYS: *S/W UPGRADE MODE* AFTER YOU HAVE RECONNECTED YOUR DEVICE TO THE USB CABLE ALLOW WINDOWS TO FIND ALL OF THE DRIVERS FOR YOUR DEVICE AUTOMATICALLY AND THEN RE-LAUNCH/RE-EXECUTE THE LG KDZ FLASH TOOL ( *UpTestEX_mod2_marwin.exe* ) AND START THE LAST PART OF STEP #6 OVER AGAIN. FOR STEP #7 YOU WILL NEED TO BE QUICK SO YOU CAN DO THE SWITCHAROO ON THE BIN FILE.
*** STEP 7: Open the folder/directory: *LG L9 - P769\LG Device Firmware Packs\Europe\Unlock Bootloader\Replacement BIN\* <--- in this directory there is a .BIN file which is named: *LGP760_AP[11].BIN* When the LG KDZ Flash Tool reports that it is at 32% you will need to quickly open the *Computer* interface on the Microsoft Windows start menu then quickly paste this string: ( C:\ProgramData\LGMOBILEAX\Phone ) <-- without the brace characters, into the location link bar at the top. Then when that directory shows that there is a file being unpacked with that same file name that you copied you will then have to quicky press *CTRL+V* on your keyboard to overwrite that file with the file that you copied, you will most likely be prompted to overwrite the file as an administrator and you have around 20 seconds to complete the prompts before that BIN file is loaded into your device firmware.
*** STEP 7 NOTES: Once the LG KDZ Flash Tool has completed uploading the European ROM/Firmware your device will restart and be recognized by your computer as a P760 version. Now comes the very frustrating part, I'm really sorry about this but everything is now both inverted and mirrored, so all of your screen presses will be mirrored. As far as I know the only way to unlock
the bootloader is with this ROM exploit. To make things easier you can navigate to Developer Settings and enable the Visible Screen Presses option so you can see where you are pressing on the screen. Flashing this European P760 KDZ Firmware Pack causes the P769 to become inverted. We flash the Europe Open ROM that is designed for the P760 onto the MS769/P769 with a locked bootloader because doing this will allow for unlocking the bootloader. Essentially what happened is LG allowed for the P760 bootloader to be unlocked in Europe on European Cell Phone Service Providers Networks, LG released an update for the P760s over the air that allowed for it to be unlocked, now since we have this KDZ pack that allows for that unlocking of the bootloader we can flash it onto the P769 and wallah! It's unlockable after that!
*** STEP 7.5: On your device, you now need to navigate to the USB mode options, just disconnect your device from the USB Cable then reconnect and it will show the connection type options make sure it is on *LG Software Mode*. Then disconnect your device from the USB Cable again and navigate to System->Developer Options and enable USB debugging and also enable installing applications
from unknown sources and finally reconnect your device to the USB Cable.
*** STEP 8: Now you will need to reroot your device again, open a Command Prompt as an administrator and type this command: *cd C:\Lelus\* <--- without the asterisk characters. Then type the command: *rootL9.bat* <--- without the asterisk characters.
The Command Prompt window will show that it is sending the SuperUser and BusyBox APK packages to the device, then your device will reboot ( if it doesn't reboot by itself you will need to reboot it ) and you will be rooted again with SuperUser and BusyBox installed.
Now you have to manage to open the File Manager on your device and install the APK package that is named: *L9RecoveryInstaller_1.5.0.APK* <-- this .APK package was copied to your device in STEP #1. The location of the APK package is: *External SD Card\TOOLS\APKs\* <-- however if you want to make it much easier with the wonky touch screen you can drop that APK package to the root of your SD Card so you don't have to click more folders.
*** STEP 9: With the L9 Recovery Installer installed on your device, open the L9 Recovery Installer application now and press: *Install Recovery*, then press: *Recovery for TWRP/CWM*.
*** STEP 9 NOTES: It is going to be so incredibly frustrating to press icons and navigate this backwards, inverted, mirror European firmware, but don't give up because you're almost done! Just remember that it's not only mirrored, but it's also inverted too! If you held your device up in front of a mirror you would be able to read it! But hey, just play around with it for a while you will figure it out.
It's a ***** let me tell you! just try to press areas under the confirmation window buttons and you will see how to get it done. Once you have the L9 Recovery installed go ahead and click the *Reboot into Recovery* option within the L9 Recovery Installer application window on your device.
*** STEP 10: Once your device reboots, you will be back in Clock Work Mod Recovery. Now you need to select the option: *Install .ZIP From SD Card*. Navigate to: *External SD Card\TOOLS\Firmware Patches\* and select the .zip file named: *radio.zip* and install it.
Then reboot the phone with the reboot option in Clock Work Mod Recovery. Once your device has rebooted back into the European ROM/Firmware unlock the screen and let it sit for 35 minutes. Make sure you have at least 1 bar on the reception icon or this won't work. Let it sit for 35 minutes then come back.
*** STEP 10 NOTES: The reason you are waiting at least 35 minutes: since you flashed the Europe Open ROM which allows for unlocking the bootloader on the P769, you now need to allow the phone to communicate with the LG servers which will send the command to your phone that allows you to reboot into the bootloader. It takes some time for this to happen, I have seen people say it
takes 35 minutes to 1 hour or more. In my own experience I only needed to wait 35 minutes, just make sure you have a good signal with at least the 3g icon or 4g/H/H+ symbol on your bars for it to work. I have also read elsewhere in my research that some people got it to work with their wifi on on top of being connected to the mobile network. If at first this next part does not work, keep trying because it will eventually work. If it doesn't work with the wifi off try it again with the wifi on, etc..
=== UNLOCKING THE BOOTLOADER
*** STEP 11: Get back on your computer and open a Command Prompt as an administrator and type the command: *cd C:\Lelus\stuff* <--- without the asterisk characters. Then type the command: *adb devices* <--- without the asterisk characters, if all is well you should have an alphanumeric string printed in your command prompt window which indicates that your device is connected
and recognized on your computer by ADB, now type the command: *adb reboot oem-unlock* <--- without the asterisk characters. If everything was done correctly your phone will reboot and you will be greeted with the fastboot OEM Unlock screen, press up on the volume rocker to permanently unlock the bootloader!!!
Now type the command: *fastboot flash recovery CWM_Touch.img* <--- without the asterisk characters. The command prompt window will show that it sent the Clock Work Mod Touch Image to the recovery partition on your device.
Now you will need to reboot the device into recovery by typing the command: *fastboot reboot recovery* <--- without the asterisk characters.
If it doesn't reboot into recovery for you then you will need to reboot into recovery by going back to the L9 Recovery Installer Application and press the option to reboot into recovery, or when rebooting your phone now that you have recovery installed the LED lights on the bottom of your phone ( Back button, Menu button ) will light up upon booting into a stock ROM, just press down on the volume rocker to boot into Clock Work Mod Recovery.
=== UNDOING THE DAMAGE FROM THE EUROPE OPEN ROM/FIRMWARE
*** STEP 12: With Clock Work Mod Recovery Touch menu booted ( Avoid using the touch screen and instead use volume up and down to move up/down and power button to select ), select: *Install .ZIP from SD Card*, then navigate back to: *External SD Card\TOOLS\Firmware Pacthes\* and install the files that are named: *20f u-boot.zip*, *cwm_ts_fix_p769.zip*, *v6.bin.zip*, and *radio.zip* one after the other.
Okay now that you have undone the noticeable damage from the Europe Open ROM/Firmware you can restore the original stock rom that you originally had installed on your device. Go ahead and select the Mounts and Storage option then Format the /system/, /cache/ and /data/ partitions, now go back and select the Backup/Restore option and restore the backup image of your stock ROM. Now reboot your device from Clock Work Mod Recovery.
Now take a breather for a couple of minutes.
OK, now that you're rested up and you understand everything you just did you can overwrite your firmware with a fully stock KDZ. Doing that at this point will completely overwrite all firmware code and remove any other damage from the Europe Open ROM. So go ahead and plug your device back into your computer and select: *LG Software Suite* for the USB connection mode. Then fire up the LG KDZ Flash Tool again. Now download the T-Mobile V20H KDZ Firmware Pack for P769 devices here: [
http://csmgdl.lgmobile.com/dn/downloader.dev?fileKey=FW959486573210987654321/V20H_00.kdz ]. Now flash that KDZ. Good thing about this latest KDZ Pack is it will also upgrade your baseband to the newest T-Mobile baseband for the P769. If you were using this guide for a P769 device that was released outside of the United States and you are using it now outside of the United States you can download the appropriate KDZ
from a list in this thread post #1: http://forum.xda-developers.com/showthread.php?t=2107971
=== INSTALLING CYANOGENMOD ROM/FIRMWARE 11 KitKat 4.4.4
*** STEP 13: After you have upgraded your stock firmware in Step #12 you will now need to install Clock Work Mod Recovery again, but this time you're going to install the latest version of it for the P769, being version 6.0.4.9 and you need this version in order to install any CM11 Firmware Image. I suggest you install KANG CyanogenMod 11 KitKat 4.4.4 because this one is the absolute best out of all of them, it is the most updated, stable and it has SELinux enabled and enforcing.
Go ahead and open the directory you unzipped from the .zip package you downloaded in this guide and navigate to the folder named: *CMahendra Tools*, copy this folder to the root of your Device SD Card, then install the eu.chainfire.supersu-1.apk, then install the LGPWN.apk and finally the com.cgollner.flashify-1.apk. Open the LGPWN application and select *Root Me* then go through the prompts and then select restore
backup. Once it restores your Device will reboot and you will have root again, now open the Flashify Recovery Image Flasher application, allow it root access when it prompts for it, then select flash recovery, select file, then navigate to Tools on your SD Card then Recovery Images and select the file named: *recovery-6.0.4.9-p769.img*. Now download the newest KANG CyanogenMod 11 KitKat 4.4.4 at this link: [
https://www.androidfilehost.com/?w=files&flid=18559 ] <--- AND MAKE SURE YOU GET THE ONE THAT IS FOR P769 AS INDICATED IN THE FILE NAME HERE. Also download the latest gApps for this ROM here: http://forum.xda-developers.com/showthread.php?t=2397942. Copy both the CM11 zip and the gApps zip to your SD Card, boot into Clock Work Mod Recovery and, Format /boot/, /system/, /cache/, /data/, and /persist/, then install the CM11 zip and the gApps zips. Reboot and you're done! Enjoy it!
=== GETTING THE SIM UNLOCK CODE
In order to put this device on other carriers such as AT&T, SimpleMobile and what have you, you will need to get the SIM Unlock Code either from various methods posted on this forum or by calling Metro PCS and asking them for the code. If you tell them you intend to go out of the country for business they will give you the code over the phone, if they try to say: "durr you can't have it unless you have 3 months of service with us" just tell them you are a US Citizen and Obama passed a law that says they have to give you the code. Worked for me anyway! LOL. If not there are other guides here that will get it done for you for free.
=== END OF TUTORIAL/GUIDE
Congratulations! You have completed the guide!
Always keep your CyanogenMod Firmware and gApps up to date so you always have the latest and the greatest!
---------------------------------------------------
That's it! You're all done!
If you liked my simplified guide let me know by saying thanks!
Thank you for reading!
And enjoy your unlocked Bootloader and CyanogenMod 11 KitKat Firmware!
Can it work with just the regular P769? Also, the sticker on the back doesn't contain the date anywhere I can see, but if I go in to the hidden menu, it says my device is August 14 2013. Am I out of luck? Thank you so much for such an easy to follow guide. I didn't even want to bother with other people's guides because they are such a mess.
hmm got secure boot error.... grr, i got a big issue now... went back to 10g and my screen is still messed up?!?!
Cobra11Murderer said:
hmm got secure boot error.... grr, i got a big issue now... went back to 10g and my screen is still messed up?!?!
Click to expand...
Click to collapse
**** sorry bro I actually forgot to add some steps at the end of the guide. Just sit tight everyone I'm in the process of updating the guide and reuploading the .zip file now.. I left it uploading while I went to work and it just keeps stopping at like 22% I have no ****ing clue why but I'm reuploading now. I just got off work, tired as **** and got something to eat but now my phone is also soft bricked so I have to update firmware with the S/W update then after that the upload should be done and I'll repost the tutorial with link. Give me like 1-2 hours hopefully. be right back.
Cobra11Murderer said:
hmm got secure boot error.... grr, i got a big issue now... went back to 10g and my screen is still messed up?!?!
Click to expand...
Click to collapse
lol wait a second what the heck?! how are you even doing the guide without the package I uploaded? LOL
CygnusBlack said:
**** sorry bro I actually forgot to add some steps at the end of the guide. Just sit tight everyone I'm in the process of updating the guide and reuploading the .zip file now.. I left it uploading while I went to work and it just keeps stopping at like 22% I have no ****ing clue why but I'm reuploading now. I just got off work, tired as **** and got something to eat but now my phone is also soft bricked so I have to update firmware with the S/W update then after that the upload should be done and I'll repost the tutorial with link. Give me like 1-2 hours hopefully. be right back.
Click to expand...
Click to collapse
Alright everyone the guide is officially complete! Have at it!!!!
Good post.. Gotta admit a little heart broken as I am one of the unfortunates with the encrypted boot loader and stop had a little hope lol
Sent from my LGMS769 using XDA Free mobile app
Somebody123456 said:
Can it work with just the regular P769? Also, the sticker on the back doesn't contain the date anywhere I can see, but if I go in to the hidden menu, it says my device is August 14 2013. Am I out of luck? Thank you so much for such an easy to follow guide. I didn't even want to bother with other people's guides because they are such a mess.
Click to expand...
Click to collapse
Um, can you please answer? Also, I don't see the Mega link anywhere.
There may be hope for you. I'm researching to find out if you can downgrade the rom to get a decrypted bootloader then you'd just follow this guide and you're set. I will post my findings.
Sent from my LG769 using XDA Free mobile app
As far as I know yes it works with the p769.. but again yours is august so I'm thinking you have an encrypted bootloader. But there's hope as I said there may be a way for you to decrypt the bootloader by downgrading to the first mfg rom. Ill let everyone know what I find out.
Sent from my LG769 using XDA Free mobile app
Somebody123456 said:
Um, can you please answer? Also, I don't see the Mega link anywhere.
Click to expand...
Click to collapse
See my above post. I forgot to quote you.. and the mega link is still coming I had to repack the files and its uploading still. My upload speed is around 300kb up so its going to take a while since the new pack is 2gb
Sent from my LG769 using XDA Free mobile app
CygnusBlack said:
There may be hope for you. I'm researching to find out if you can downgrade the rom to get a decrypted bootloader then you'd just follow this guide and you're set. I will post my findings.
Sent from my LG769 using XDA Free mobile app
Click to expand...
Click to collapse
Thank you very much!
CygnusBlack said:
lol wait a second what the heck?! how are you even doing the guide without the package I uploaded? LOL
Click to expand...
Click to collapse
I used another guide.. i used the wrong kdz lol, got the right one and got the radio flashed and all.. waited, and guess what? it just restarted... :| and my phone was made in jan 2013!!!, I tried many times over and over, I think I might need the cable for it.. mine is a TMobile version though but i doubt that makes any difference compared to the Metro's they are exactly the same
Cobra11Murderer said:
I used another guide.. i used the wrong kdz lol, got the right one and got the radio flashed and all.. waited, and guess what? it just restarted... :| and my phone was made in jan 2013!!!, I tried many times over and over, I think I might need the cable for it.. mine is a TMobile version though but i doubt that makes any difference compared to the Metro's they are exactly the same
Click to expand...
Click to collapse
well I was finally able to get it uploaded to Mega. I posted the link in the tutorial post. Since you're using the T-Mobile version what you should do is first downgrade your rom to the oldest T-Mobile rom. There's a post in this forum by CMahendra I think and he put up links to all the roms. Get the oldest tmobile flash that first then flash the Europe open rom like in my tutorial and follow the rest of my tutorial it should work.
Let me know what happens. If it doesn't work you can just flash the firmware patches to fix your screen and touch screen then flash back to stock rom.
CygnusBlack said:
well I was finally able to get it uploaded to Mega. I posted the link in the tutorial post. Since you're using the T-Mobile version what you should do is first downgrade your rom to the oldest T-Mobile rom. There's a post in this forum by CMahendra I think and he put up links to all the roms. Get the oldest tmobile flash that first then flash the Europe open rom like in my tutorial and follow the rest of my tutorial it should work.
Let me know what happens. If it doesn't work you can just flash the firmware patches to fix your screen and touch screen then flash back to stock rom.
Click to expand...
Click to collapse
I actually did do that, in fact.. i was on the latest of tmobile 20h i believe, used fastboot method to go back down to the oldest then went to turkey... when i found out i got the wrong one i fast boot back down again and flashed the correct one still no go.. now my screen is still inverted when flashed back to stock old.. but no biggie ive been using a backup phone lol, i do however need to try again or get it back to original stock state..
if this doesnt unlock im even considering the samsung avant lol
Cobra11Murderer said:
I actually did do that, in fact.. i was on the latest of tmobile 20h i believe, used fastboot method to go back down to the oldest then went to turkey... when i found out i got the wrong one i fast boot back down again and flashed the correct one still no go.. now my screen is still inverted when flashed back to stock old.. but no biggie ive been using a backup phone lol, i do however need to try again or get it back to original stock state..
if this doesnt unlock im even considering the samsung avant lol
Click to expand...
Click to collapse
Try to root it now with that Lelus tool then go to CWM recovery and flash the inverted screen patch + wonky touch screen patch + radio patch. Maybe that will fix it. The Europe rom ****s a lot of stuff up and going to back original rom won't flash the actual firmware back completely. I suspect there's actually more damage/changes from the europe rom since it was hex edited(?) but at least if you flash those it will fix your screen and touch screen and radio.
CygnusBlack said:
Try to root it now with that Lelus tool then go to CWM recovery and flash the inverted screen patch + wonky touch screen patch + radio patch. Maybe that will fix it. The Europe rom ****s a lot of stuff up and going to back original rom won't flash the actual firmware back completely. I suspect there's actually more damage/changes from the europe rom since it was hex edited(?) but at least if you flash those it will fix your screen and touch screen and radio.
Click to expand...
Click to collapse
alrighty will do that now, its updating as i type.. whats even more funny is all drivers are installed on a fresh pc.. this pc i cleared and this is the only device hooked up to it.. the bootloader is def a shoot and miss with this device, thats why im wonderin about the cable that might work, but i have no idea if it will actually.. lol
Cobra11Murderer said:
alrighty will do that now, its updating as i type.. whats even more funny is all drivers are installed on a fresh pc.. this pc i cleared and this is the only device hooked up to it.. the bootloader is def a shoot and miss with this device, thats why im wonderin about the cable that might work, but i have no idea if it will actually.. lol
Click to expand...
Click to collapse
Any progress yet?
edit:nevermind
Finally got tired of the Pixel 2 XL after the third one. Now I have this super rugged handset that I can actually hold on to! Great loud audio too!
The Sonim XP8 comes with a seemingly near stock Android 7.1.1 ROM. OEM unlocking is available in the developer options. I have it enabled. Does anyone know how to use the ADB/Fastboot tools to unlock it? The standard commands do not work. My unit is personal and not under any "enterprise" restrictions. Thanks for any help fellow hackers ... some TWRP would be awesome.
ctradio said:
Does anyone know how to use the ADB/Fastboot tools to unlock it? The standard commands do not work. My unit is personal and not under any "enterprise" restrictions. Thanks for any help fellow hackers ... some TWRP would be awesome.
Click to expand...
Click to collapse
(Im)patiently waiting for this too. I don't care if it is single touch or long drawn out process involving a cauldron, hermetic circle, and a full moon. Root is sorely needed...
Phuhque said:
(Im)patiently waiting for this too. I don't care if it is single touch or long drawn out process involving a cauldron, hermetic circle, and a full moon. Root is sorely needed...
Click to expand...
Click to collapse
Good luck! Still nothing. It looks like we might be able to sign up as a developer on their page .... fwiw. I find the interface on that device to be awful and am in the early stages of fighting AT&T for my money back. That device and another one with the same stupid issues and an admitted software problem that I'd have to wait for the carrier to decide to release. Awesone idea for a device, absolutely rushed to market with god awful software that was new in '16 or so.
ctradio said:
I find the interface on that device to be awful and am in the early stages of fighting AT&T for my money back. .
Click to expand...
Click to collapse
I am on T-Mobile and found the factory unlocked version with no bloatware (obtainable directly from the) to be rather refreshing, even if it did set me back an extra $100. I suggest do getting the refund, then turning around and getting the "clean" version. It may be more expensive, but considering how much it costs for monthly insurance, the overall price becomes somewhat more competitive with the 3 year "comprehensive" warranty...
Phuhque said:
I am on T-Mobile and found the factory unlocked version with no bloatware (obtainable directly from the) to be rather refreshing, even if it did set me back an extra $100. I suggest do getting the refund, then turning around and getting the "clean" version. It may be more expensive, but considering how much it costs for monthly insurance, the overall price becomes somewhat more competitive with the 3 year "comprehensive" warranty...
Click to expand...
Click to collapse
I was told there was no carrier unlocked variant of this thing. Didyou get it from Sonim? Also, any problems at all with it? I had two with touch issues along the right side of the screen (it perceives a light constant touch in various areas and it gets worse the longer the screen is on). The units would eventually start selecting things on its own and even deleting contacts. Also, the speaker phone is useless and the UI is horribly laggy at times (my mind operates fast and it screws with me). I presented them with a "laundry list" of the issues.
ctradio said:
I was told there was no carrier unlocked variant of this thing. Didyou get it from Sonim? Also, any problems at all with it? I had two with touch issues along the right side of the screen (it perceives a light constant touch in various areas and it gets worse the longer the screen is on). The units would eventually start selecting things on its own and even deleting contacts. Also, the speaker phone is useless and the UI is horribly laggy at times (my mind operates fast and it screws with me). I presented them with a "laundry list" of the issues.
Click to expand...
Click to collapse
Someone flat out lied to you. Go here: https://store.sonimtech.com/products/sonim-xp8-blk-nam
Well, maybe not lied at the time you were told... I waited several months for them to post it on their store page. In response to your concerns....
No issues with it going all AI on me. Speaker PHONE portion leaves a bit to be desired, but for audio books, this thing is damned awesome and really loud. Not sure how to reference the lag. My previous phone was a Note 4 with issues.
My own complaints. The lock screen is a pain. The default music program is broken in my opinion. I am suffering through with Musicolet for my books.
What sold me on this is that is is one of the last phones made today that has a removable battery (really my only requirement in a new phone), has both gps an glonass, and in a pinch I can use is an a hurled object to an opponents head. Someone complained about the camera, but it seems fine to me. Wouldn't matter much as I am partially colorblind and won't see any difference.
I have only had mine for a week, and am still tweaking the settings to how I want them. Honestly, I like it.
I would really love to see some support for this phone. Especially since the monsters at Telus have disabled the 2nd sim slot for no good reason. I have tried everything but without Root I am out of luck getting the dual sim feature to function. Is there anything I can provide to assist someone more knowledgeable in getting a root solution for this phone? Please let me know.
mertin said:
I would really love to see some support for this phone. Especially since the monsters at Telus have disabled the 2nd sim slot for no good reason. I have tried everything but without Root I am out of luck getting the dual sim feature to function. Is there anything I can provide to assist someone more knowledgeable in getting a root solution for this phone? Please let me know.
Click to expand...
Click to collapse
Hello,
I just bought this phone. I use 2 sim cards at the same time but it does not work properly: I can receive and make calls, but I can not send or review sms / mms on 1 operator. I use the xp8800 in France, it is a Att model unlocked. to have the 2 sim cards at the same time I rebooted several times, cut the data, without really understanding how I did . is there a way to restart the network part of Android ?
Thanks
Pascal S
I take it we are still coming up snake-eyes when it comes to someone being able to root the XP8. I am rather surprised with the fact it is on 7.1.1. Is this still an unbeatable task to overcome?
The thread is closed, this is the tested version of the firmware
Unlock fastboot
Step 1, open the developer mode
Go to “Settings” → “About Phone” and click “Version Number” 7 times to open Developer mode.
Step 2, open oemlock
Go to “Settings” → “Other Settings” → “Developer Mode” and open the OEM to unlock;
3 START mode
flash <partition> [ <filename> ] Write a file to a flash partition.
flashing lock Locks the device. Prevents flashing.
flashing unlock Unlocks the device. Allows flashing
any partition except
bootloader-related partitions.
flashing lock_critical Prevents flashing bootloader-related
partitions.
flashing unlock_critical Enables flashing bootloader-related
partitions.
flashing get_unlock_ability Queries bootloader to see if the
device is unlocked.
flashing get_unlock_bootloader_nonce Queries the bootloader to get the
unlock nonce.
flashing unlock_bootloader <request> Issue unlock bootloader using request.
flashing lock_bootloader Locks the bootloader to prevent
bootloader version rollback.
erase <partition> Erase a flash partition.
Firmware update soon.. ??
In May, I sent of another email to Sonim Tech support asking about firmware. I did get a response back. Granted it was rather vague, but it was an answer. Further granted, is is now mid June and no updates in sight including one that allows the viewing of PDF's. grrrr.
The support guy did mention that AT&T is going to be one of the first providers to get the update. That sucks for me because I got my unit direct. He also said the month of May was a non-official time frame.
So still waiting and no success story yet posted of anyone unlocking this little beastie.
https://www.att.com/devicehowto/tutorial.html#!/stepbystep/id/stepbystep_KM1259507?make=Sonim&model=XP8XP8800
No idea how to update manually, though...
Phuhque said:
In May, I sent of another email to Sonim Tech support asking about firmware. I did get a response back. Granted it was rather vague, but it was an answer. Further granted, is is now mid June and no updates in sight including one that allows the viewing of PDF's. grrrr.
The support guy did mention that AT&T is going to be one of the first providers to get the update. That sucks for me because I got my unit direct. He also said the month of May was a non-official time frame.
So still waiting and no success story yet posted of anyone unlocking this little beastie.
Click to expand...
Click to collapse
No idea how to update manually, though...[/QUOTE]
Thanks for the news , but no working to ATT from France , until in OTA .
Wait and see if dual sim working clean ....
Has anyone seen this video? There's a part in the video where as the guy turns it on, and there is a prompt to re-lock the bootloader(which, of course, implies that the bootloader is unlocked); I don't know how this really helps, but it might give someone more experienced than I something to grab at. I should mention that it is mentioned as a pre-production model of the Sonim XP8, so it probably won't apply to models that most people have, but it's something to look at.
Sonim XP8
I know that Verizon is now selling the Sonim XP8. Does anybody happen to know if it is possible to use both SIM card slots with this device after it is unlocked?
Being able to use BOTH AT&T AND Verizon would be a huge benefit to me.
is there any root yet ive tried about every root apps i cant even find working drivers for this phone
Thecctech said:
is there any root yet ive tried about every root apps i cant even find working drivers for this phone
Click to expand...
Click to collapse
Drivers are not an issue.. It's using Qualcomm reference designs from the S660 dev kit where most generic Qualcomm drivers should work with minimal modification.
This is a good thing! Most of the root apps are using a collection of known exploits where only vulnerable devices would fall victim. You would have to use an exploit that's more recent then the security patch level installed but you also have to remember - if you can do it that easily then an attacker can do it just as easily too! I personally believe that the association between root and device/firmware level vulnerabilities is the reason why most see root in a negative context today.
As far as I'm concerned - we only have 2 "correct" ways to achieve root.
1. Obtain (or compile) either a Debug or Engineering firmware variant from AT&T that includes the native su packages for adb root. This is usually not an option for us individuals.
2. Unlock the bootloader and use a patched boot image.. Works great! To unlock the bootloader takes a bit of work though and flashing still requires EDL so with that I have not been able to make a public instruction set yet.
Could be in the next few days.. Could be in the next few months.. I'm honestly not sure. Mostly just a matter of collecting images, testing, and finding time.
Enjoy!
XP8 Android Root Theory - DEBUG or Magisk over EDL
EDL is a must since Fastboot cannot be unlocked initially from standard "user" builds.
One option is flash a userdebug image (below) allowing for adb root, fastboot unlocking, and other useful features.
or
Without unlocking the bootloader - Similar flashing methods remain valid when standard magisk powered root is desired. This method allows preservation of all current system data aside from boot.img. All is covered since Magisk works with AVB and we have EDL as a flashing alternative. Please see Android Boot Flow > LOCKED Devices with Custom Root of Trust for more information.
Recommend method ..
It's up to you.. If you want OTA updates and your planning to use root apps then go with Magisk. As of today we have current debug images available and I personally prefer isolated adb root access only however future availability of updated Debug images cannot be guaranteed.
Disclaimer
-Devices with locked bootloaders will display a custom OS warning at boot
-Tested on AT&T branded devices only - please provide system dump for validation on other builds
-I have not identified any JTAG procedures and I can not help if you hard brick your device!
-This guide only touches boot_a and should be relatively safe since boot_b remains unmodified. I'm pretty sure this is enough to restore the original boot.img to boot_a under a failure scenario.. But I'm not really qualified enough to say definitively either.
-Take great caution - this is raw emmc access and critical system data! You are proceeding at your own risk!
Magisk Root
Step 1 - Pull Boot.img
We need to pull the boot.img in order to feed it to magisk later for patching. It's also good to keep on hand for if/when you need to restore for any reason.
1. Create an XML file with the data below
Code:
<?xml version="1.0"?>
<data>
<program start_sector="262144" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="131072" label="boot_a" filename="boot.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>
</data>
2. Boot to EDL mode and load firehose programmer
Code:
QSaharaServer.exe -p \\.\COM<#> -s 13:prog_emmc_ufs_firehose_Sdm660_ddr.elf
3. Backup boot.img using the following command
Code:
fh_loader.exe --convertprogram2read --port=\\.\COM<#> --sendxml=<xmlfile.xml> --lun=0 --memoryname=emmc --noprompt --reset
Or visit the XP8 carrier firmware thread for full system backup steps.
https://forum.xda-developers.com/showpost.php?p=80465045&postcount=6
Step 2 - Magisk Patch
1. ADB push boot.img /storage/self/primary/Download/
2. Install Magisk Manager and apply patch to boot.img
2a. Download from https://forum.xda-developers.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445
2b. Extract and run adb install magisk.apk
2c. Open Magisk app and apply patch to boot.img
3. ADB pull /storage/self/primary/Download/magisk_patched.img
Step 3 - Restore
1. Change the filename attribute in the XML to reflect newly created magisk_patched.img as shown below
Code:
<?xml version="1.0"?>
<data>
<program start_sector="262144" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="131072" label="boot_a" filename="magisk_patched.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>
</data>
2. Boot back into EDL mode and load firehose programmer
Code:
QSaharaServer.exe -p \\.\COM<#> -s 13:prog_emmc_ufs_firehose_Sdm660_ddr.elf
3. Apply magisk_patched.img using the following command
Code:
fh_loader.exe --port=\\.\COM<#> --sendxml=<xmlfile.xml> --lun=0 --memoryname=emmc --noprompt --reset
USERDEBUG Flash
Step 1 - Backup
1. Boot to EDL mode and load firehose programmer
2. Generate rawprogram0.xml - Run GPTConsole <COM Number>
Example: GPTConsole 19
3. Initiate backup
Code:
fh_loader.exe --port=\\.\COM<#> --convertprogram2read --sendxml=rawprogram0.xml --lun=0 --memoryname=emmc --noprompt --reset
4. Wipe all partitions
Code:
fh_loader.exe --port=\\.\COM<#> --convertprogram2read --sendxml=erase.xml --lun=0 --memoryname=emmc --noprompt --reset
5. Restore new image
Code:
fh_loader.exe --port=\\.\COM<#> --sendxml=rawprogram0.xml --lun=0 --memoryname=emmc --noprompt --reset --search_path=<extracted image file directory>
// rawprogram0_unsparse.xml for some images
Images and OTA Files
Full 8.1 System Image
XP8A_ATT_user_8A.0.5-11-8.1.0-10.54.00
XP8A_ATT-user-8A.0.5-10-8.1.0-10.49.00
USERDEBUG Images
XP8A_ATT_userdebug_8A.0.5-11-8.1.0-10.54.00
XP8A_ACG-userdebug-8A.0.0-00-7.1.1-32.00.12
XP8A_USC-userdebug-8A.0.0-00-7.1.1-34.00.10
(ATT 7.1 pending upload. Please check back or use other links available further in thread.)
OTA Updates
XP8_ATT_user_N10.01.75-O10.49.00
XP8_ATT_user_O10.49.00-O10.54.00
XP8_TEL_user_N12.00.24-O12.23.00
Flash Tools - programmer (elf) file provided by eleotk!
XP8 Drivers
Firmware Carrier Codes
Code:
None = 0,
ATT = 10
Bell = 11
Telus = 12
Sasktel = 13
Harris = 14
Verizon = 15
Ecom = 16
NAM = 17
Rogers = 18
T_Mobile = 19
EU_Generic = 20
MSI = 21
CISCO = 22
NAM_Public_Safety = 23
Vodafone_Global = 24
Orange = 25
Southern_Linc = 26
OPTIO = 27
India = 28
SPRINT = 29
JVCK = 30
AUS = 31
ACG = 32
CSPIRE = 33
USC = 34
SB = 35
Multi = 99
Automatic OTA without AT&T service:
Purchase a blank AT&T SIM card ($5)
Start online prepaid activation - complete pages 1 & 2
**SIM Card is now partially active without funding - do not complete page 3 (payment)***
*#*#368378#*#* > Clear UI > Check for updates in settings
XP5s
Sprint Image: XP5SA.0.2-03-7.1.2-29.03.00
Works the same. Tested with unmodified Sprint firmware. Like most other apps, the Magisk manager app is unusable since the XP5s has no touch screen - I had to patch the boot image on another device. You can plug in a USB mouse however the cursor does not seem to invoke in-app tap's.
Need to use the appropriate Firehose loader (prog_emmc_firehose_8920.mbn) and replace the boot image location according to the XP5s GPT (start_sector="790528").
Great, thanks alot for instructions, @smokeyou!
In order to be able to boot into patched boot image, does it require to have unlocked bootloader? Assuming I can upgrade my phone to build 8A.0.5-10-8.1.0-10.49.00, but have my bootloader locked, can I still use your instructions? Can you clarify it?
-albertr
albert.r said:
Great, thanks alot for instructions, @smokeyou!
In order to be able to boot into patched boot image, does it require to have unlocked bootloader? Assuming I can upgrade my phone to build 8A.0.5-10-8.1.0-10.49.00, but have my bootloader locked, can I still use your instructions? Can you clarify it?
-albertr
Click to expand...
Click to collapse
Untested but should not be a problem. Bootloader unlocking only allows Fastboot flashing where this method uses EDL only.
Basically the same outcome though just without the option to use TWRP or custom recovery (easily).
Phone Specs :
Model : A250DL (also referred to as TCL LX)
Android : 8.1.0
Arch : armv7
Kernel : 4.4.95+ (gcc version
6.3.1 20170404)
([email protected] #1)
Build Number : vG7a
Custom build version :
alps-mp-o1.mp1-V1.112_k39tv1.bsp_P15
Baseband Version :
MOLY.LR12A.R3.MP.V10.3.P24
Bootloader : U5G7A0A0CT00
(edit)
Seems the device has a mediatek processor, MT6739
I found a twrp build for this processor, however it does not cooperate with SP Flash Tool, the phone comes up then reboots
almost immediately
OEM Unlocking is available in developer settings, however i can't boot the phone into any other mode besides recovery mode. I've tried a number of button combos as well as 'adb reboot fastboot'. If anyone knows how to enter fastboot mode / know of a TWRP build for this device that'd be great. Thanks
Hi I also that the tcl lx I was wondering if you were ever able to get the phone rooted because I've wanted to root my phone but I haven't found a root for it yet if you could get back to my i would appreciate it
steine said:
Hi I also that the tcl lx I was wondering if you were ever able to get the phone rooted because I've wanted to root my phone but I haven't found a root for it yet if you could get back to my i would appreciate it
Click to expand...
Click to collapse
Hey sorry for the late reply I forgot about this thread if im being honest sadly I never made any progress and ended up bricking the device after trying to install twrp with sp flash tool (the scatter file I used wasn't valid). I'll check my history and see if I can find relevant links but there was a twrp build for this somewhere. The problem for me was getting a scatter file which lead me to bricking. However there is a new exploit for mediatek cpu's (mtk-su) its only been tested on a couple Amazon devices (it was developed as a software root exploit for some Kindle's) but it may work for this as well. I will warn you now though if you end up bricking this it's impossible (to my knowledge) to restore it. Best of luck !
Has anyone made any progress or seen any threads that have gotten further? Just got this phone myself to replace my last as it ended up being same price as said last phone but its an upgrade to boot.
crazypwn said:
Has anyone made any progress or seen any threads that have gotten further? Just got this phone myself to replace my last as it ended up being same price as said last phone but its an upgrade to boot.
Click to expand...
Click to collapse
Also looking for help on rooting this phone. Has anyone found it yet?
There are three major obstacles with rooting this device. First, there doesn't appear to be any type of exploit or official support for unlocking the bootloader. Second, the boot chain is secured with AVB 2.0 signing. Third, the kernel is coded with dm-verity. So, even if SP Flash Tool could be used to flash the boot partition with a patched boot image (systemless root), the secure boot chain will detect the modification and fail to boot the OS. Likewise, if SP Flash Tool could be used to push a pre-rooted system image (system-wide root), device mapping will detect the change to /system and fail to boot into the OS. Like many TCL devices running more recent Android versions, it appears that the Alcatel A250DL cannot be rooted.
Mtk-su seems to work fine
Mtke-su seems to work fine:
github -> /JunioJsv/mediatek-easy-root/blob/master/app/src/main/assets/mtk-su
Log:
param1: 0x1000, param2: 0x8040, type: 13
Building symbol table
kallsyms_addresses pa 0x40eda580
kallsyms_num_syms 51245, addr_count 51245
kallsyms_names pa 0x40f0c650, size 671079
kallsyms_markers pa 0x40fb03c0
kallsyms_token_table pa 0x40fb06f0
kallsyms_token_index pa 0x40fb0a70
Patching credentials
Parsing current_is_single_threaded
c04e5d58: LDR Rt, [PC, #128] ; 0xc04e5de0
init_task VA: 0xc140c578
Potential list_head tasks at offset 0x2b0
comm swapper/0 at offset 0x454
Found own task_struct at node 1
cred VA: 0xd7cf8b80
thread_info flags VA: 0xcd2de000
seccomp mode VA: 0xc3fc4930+20c
Parsing avc_denied
c0485bbc: LDR Rt, [PC, #84] ; 0xc0485c18
selinux_enforcing VA: 0xc15a56d4
Setting selinux_enforcing
Switched selinux to permissivearmv7l machine
starting /system/bin/sh
UID: 0 cap: 3fffffffff selinux: permissive
returned 0
---------- Post added at 10:46 AM ---------- Previous post was at 10:23 AM ----------
Nevermind....no super app binary installed
Viva La Android said:
There are three major obstacles with rooting this device. First, there doesn't appear to be any type of exploit or official support for unlocking the bootloader. Second, the boot chain is secured with AVB 2.0 signing. Third, the kernel is coded with dm-verity. So, even if SP Flash Tool could be used to flash the boot partition with a patched boot image (systemless root), the secure boot chain will detect the modification and fail to boot the OS. Likewise, if SP Flash Tool could be used to push a pre-rooted system image (system-wide root), device mapping will detect the change to /system and fail to boot into the OS. Like many TCL devices running more recent Android versions, it appears that the Alcatel A250DL cannot be rooted.
Click to expand...
Click to collapse
yeah after much research I was just going to make this phone a youtube/remote for my older tv . . . .I found no options either. .
Hi, I have a Huawei Mate 10 pro BLA-L29 C432 with unlocked bootloader frp unlocked that is hard bricked.
Reason why it was hard bricked was using HWota and flashing the wrong files
The device shows up in device manager as USB COM 1.0 (COM4) along with COMMUNICATIONS PORT (COM 1).
I have purchased the DC Phoneix + HCU timed license for 3 days ending on 3/4/2019 at 9 AM.
I have downloaded the "BLA-AL00B_1.0.0.35_Board_Software_China_Nonspecific_An droid_8.0.0_EMUI_8.0.0_05022FPT.dgtks" board firmware directly from DC Phoenix
I have also downloaded the "BLA-L29C_8.0.0.115(C432)_Firmware_Lithuania_Latvia_Norway_Romania_Hungary_Greece_Austria_Czech_Republic_Bulgaria_Poland_Slovenia_Croatia_Serbia_Nonspecific.app" appfile directly from DC Phoenix
I begin by selecting the "BLA-AL00B_1.0.0.35_Board_Software_China_Nonspecific_An droid_8.0.0_EMUI_8.0.0_05022FPT" file in the update file selection. Then i select the "BLA-L29C_8.0.0.115(C432)_Firmware_Lithuania_Latvia_Norway_Romania_Hungary_Greece_Austria_Czech_Republic_Bulgaria_Poland_Slovenia_Croatia_Serbia_Nonspecific.app" file in the update app file selection.
I click update and am provided with the following error message to the left of the screen
File to update: BLA-AL00B_1.0.0.35_Board_Software_China_Nonspecific_An droid_8.0.0_EMUI_8.0.0_05022FPT.dgtks
Device detected:
COM4: HUAWEI USB COM 1.0 (COM4)
Writing bootloader...
Writing BLA-AL00B_1.0.0.35_Board_Software_China_Nonspecific_An droid_8.0.0_EMUI_8.0.0_05022FPT_3.dtwork...
Error writing Bootloader
3/1/2019 1:09:05 PM Writing device finished - INCOMPLETE
I then proceeded to try the "use bootloader" option under the udpate oeminfo tab and chosen the Kiring970_T2_A8.0_V3
and i have successfully gotten my device to be recognized as follows
Looking for a device in fastboot mode
Device found: AQH7N17B29009368
SN:AQ********************* <- i have censored the following information intentionally
IMEI:866******************* <- i have censored the following information intentionally
IMEI1:86******************* <- i have censored the following information intentionally
MEID:A******************** <- i have censored the following information intentionally
Build number: :BLA-L29 8.0.0.158(C432)
Model: BLA-L29
Battery state: 0
When writing the board file, I get the following
Erasing nvme partition
ERASE partition nvme : FAIL failed to erase partition
Device with unsupported security patch
3/2/2019 11:47:18 AM Writing device finished OK
when writing the update.app file directly from dc-phoenix i get the following error
Extracting partition XLOADER...
Writing XLOADER partition
XLOADER partition UPDATE :FAIL download elf_xloader image verification error
Device with unsupported security patch
3/2/2019 12:02:09 PM Writing device finished - INCOMPLETE
i then though, okay let me try another more rescent .app file, so i downloaded the 8.0.0.158 BLA-L29 c432 "update.zip" file from the internet. I extracted the "UPDATE.APP" file and then selected it in DC-Phoneix and now i get the following message
Attention, this is OTA type file and can't be written via software. Writing it via fastboot may damage the phone. Please use files from our support area.
so I select no, because of this error. I chose to download more "update.zip" files from the internet, and they all give me this attention message.
i then proceeded to use huawei extractor tool to extract kernel,ramdisk,recovery_ramdisk, recovery_vbmeta, and recovery_vendor. I flashed them through fastboot successfully, but no life from the device. As a matter of fact, when i disconnect the device, I have to start from scratch again.
I am really running out of ideas here. =(
Chito307 said:
Hi, I have a Huawei Mate 10 pro BLA-L29 C432 with unlocked bootloader frp unlocked that is hard bricked.
Reason why it was hard bricked was using HWota and flashing the wrong files
The device shows up in device manager as USB COM 1.0 (COM4) along with COMMUNICATIONS PORT (COM 1).
I have purchased the DC Phoneix + HCU timed license for 3 days ending on 3/4/2019 at 9 AM.
I have downloaded the "BLA-AL00B_1.0.0.35_Board_Software_China_Nonspecific_An droid_8.0.0_EMUI_8.0.0_05022FPT.dgtks" board firmware directly from DC Phoenix
I have also downloaded the "BLA-L29C_8.0.0.115(C432)_Firmware_Lithuania_Latvia_Norway_Romania_Hungary_Greece_Austria_Czech_Republic_Bulgaria_Poland_Slovenia_Croatia_Serbia_Nonspecific.app" appfile directly from DC Phoenix
I begin by selecting the "BLA-AL00B_1.0.0.35_Board_Software_China_Nonspecific_An droid_8.0.0_EMUI_8.0.0_05022FPT" file in the update file selection. Then i select the "BLA-L29C_8.0.0.115(C432)_Firmware_Lithuania_Latvia_Norway_Romania_Hungary_Greece_Austria_Czech_Republic_Bulgaria_Poland_Slovenia_Croatia_Serbia_Nonspecific.app" file in the update app file selection.
I click update and am provided with the following error message to the left of the screen
File to update: BLA-AL00B_1.0.0.35_Board_Software_China_Nonspecific_An droid_8.0.0_EMUI_8.0.0_05022FPT.dgtks
Device detected:
COM4: HUAWEI USB COM 1.0 (COM4)
Writing bootloader...
Writing BLA-AL00B_1.0.0.35_Board_Software_China_Nonspecific_An droid_8.0.0_EMUI_8.0.0_05022FPT_3.dtwork...
Error writing Bootloader
3/1/2019 1:09:05 PM Writing device finished - INCOMPLETE
I then proceeded to try the "use bootloader" option under the udpate oeminfo tab and chosen the Kiring970_T2_A8.0_V3
and i have successfully gotten my device to be recognized as follows
Looking for a device in fastboot mode
Device found: AQH7N17B29009368
SN:AQ********************* <- i have censored the following information intentionally
IMEI:866******************* <- i have censored the following information intentionally
IMEI1:86******************* <- i have censored the following information intentionally
MEID:A******************** <- i have censored the following information intentionally
Build number: :BLA-L29 8.0.0.158(C432)
Model: BLA-L29
Battery state: 0
When writing the board file, I get the following
Erasing nvme partition
ERASE partition nvme : FAIL failed to erase partition
Device with unsupported security patch
3/2/2019 11:47:18 AM Writing device finished OK
when writing the update.app file directly from dc-phoenix i get the following error
Extracting partition XLOADER...
Writing XLOADER partition
XLOADER partition UPDATE :FAIL download elf_xloader image verification error
Device with unsupported security patch
3/2/2019 12:02:09 PM Writing device finished - INCOMPLETE
i then though, okay let me try another more rescent .app file, so i downloaded the 8.0.0.158 BLA-L29 c432 "update.zip" file from the internet. I extracted the "UPDATE.APP" file and then selected it in DC-Phoneix and now i get the following message
Attention, this is OTA type file and can't be written via software. Writing it via fastboot may damage the phone. Please use files from our support area.
so I select no, because of this error. I chose to download more "update.zip" files from the internet, and they all give me this attention message.
i then proceeded to use huawei extractor tool to extract kernel,ramdisk,recovery_ramdisk, recovery_vbmeta, and recovery_vendor. I flashed them through fastboot successfully, but no life from the device. As a matter of fact, when i disconnect the device, I have to start from scratch again.
I am really running out of ideas here. =(
Click to expand...
Click to collapse
sorry bro i never ran into situation like this
only pray for you
Anyone? =(
Chito307 said:
Anyone? =(
Click to expand...
Click to collapse
you already done what may be possible to recover
huawei can do it if it is in warranty
It's seems that the error is right there , the security patch isn't supported so it won't finish writing the files, it is stated in DC locker that some devices like mate 10 pro and newer devices are not supported the same reason why there are no new unlocked codes for bootloader on DC unlock and no new unlocked codes for sim also, have your tried flashing those files yourself through fastboot method ? With out the hcu from DC
?
I had same problème
Now phone is OK but IMEI 000000000000
This worked for me, it requires IDT and unencrypted board firmware (these are usually paid). dtgks might work if you only flash board firmware, but you have to be careful so it doesn't wipe oeminfo (if you still want to unlock after. You can still get unlock code through HCU on board firmware so it doesn't really matter).
Edit xml that comes with unencrypted board so it doesn't erase oeminfo.
Flash bootloader files with DC, phone is put in fastboot mode.
Open up IDT.
Select xml in both settings of IDT and in settings of USBMAP. In USBMAP, select com port in the list and click on Skip.
Now start flashing using IDT.
When flashing is done phone will boot to board firmware.
When on board firmware, follow this guide to get your imeis and that stuff back:
1)Flash board (already done)
2)Flash oeminfo from fastboot (own backup if available, if you edited xml you will still have your own oeminfo flashed)
3) Dump modemnvm_system, modemnvm_factory and modemnvm_backup partitions using dd and adb shell ('dd if=/dev/block/bootdevice/by-name/modemnvm_system of=/sdcard/modemnvm_system.img' and so on), board firmware has global root so you don't need to flash Magisk or anything like that (which is impossible anyway, board fw will only accept board or stock images)
4)Flash dumped modemnvm_system, modemnvm_factory and modemnvm_backup using fastboot
5)Modify and brand with HCU (check all checkboxes except the last 2, fill in any missing info)
6)Unlock Sim network with HCU
7)If you previously used HCU to get unlock code you need to generate it again (HCU patches oeminfo so their unlock code works). Also if you forgot to edit xml you'd have to generate a new code, your old code will not work if oeminfo was wiped.
8)Use dload with Service Firmware from androidhost.ru, regular update.zip does not work in dload mode.
And make sure the firmware you dload is newer than GPU Turbo firmware. (XLOADER needs to be 02, else you brick again)
Please note that you only have one shot at this... If you, for example, flash dload but forget to generate unlock code and don't have your own oeminfo flashed you will not be able to repair device without opening it up to get testpoint.
ante0 said:
it requires IDT
Click to expand...
Click to collapse
What is IDT ?
badmania98 said:
What is IDT ?
Click to expand...
Click to collapse
Image Download Tool, some leaked tool (like Odin for Samsung).
It's available on androidhost.ru iirc
I need dload with Service Firmware please
I flashed with many firmware no seccess
ante0 said:
This worked for me, it requires IDT and unencrypted board firmware (these are usually paid). dtgks might work if you only flash board firmware, but you have to be careful so it doesn't wipe oeminfo (if you still want to unlock after. You can still get unlock code through HCU on board firmware so it doesn't really matter).
Edit xml that comes with unencrypted board so it doesn't erase oeminfo.
Flash bootloader files with DC, phone is put in fastboot mode.
Open up IDT.
Select xml in both settings of IDT and in settings of USBMAP. In USBMAP, select com port in the list and click on Skip.
Now start flashing using IDT.
When flashing is done phone will boot to board firmware.
When on board firmware, follow this guide to get your imeis and that stuff back:
1)Flash board (already done)
2)Flash oeminfo from fastboot (own backup if available, if you edited xml you will still have your own oeminfo flashed)
3) Dump modemnvm_system, modemnvm_factory and modemnvm_backup partitions using dd and adb shell ('dd if=/dev/block/bootdevice/by-name/modemnvm_system of=/sdcard/modemnvm_system.img' and so on), board firmware has global root so you don't need to flash Magisk or anything like that (which is impossible anyway, board fw will only accept board or stock images)
4)Flash dumped modemnvm_system, modemnvm_factory and modemnvm_backup using fastboot
5)Modify and brand with HCU (check all checkboxes except the last 2, fill in any missing info)
6)Unlock Sim network with HCU
7)If you previously used HCU to get unlock code you need to generate it again (HCU patches oeminfo so their unlock code works). Also if you forgot to edit xml you'd have to generate a new code, your old code will not work if oeminfo was wiped.
8)Use dload with Service Firmware from androidhost.ru, regular update.zip does not work in dload mode.
And make sure the firmware you dload is newer than GPU Turbo firmware. (XLOADER needs to be 02, else you brick again)
Please note that you only have one shot at this... If you, for example, flash dload but forget to generate unlock code and don't have your own oeminfo flashed you will not be able to repair device without opening it up to get testpoint.
Click to expand...
Click to collapse
Hello
I do every thing on the tuto but i have 1 problem
I have no network it still no service
I got another Nord n20 cp model direct from OnePlus not T-Mobile does anyone know where I could find stock firmware for it?
Specifically CPH2459 A 07
I have tried the flash tool, but it's confusing and I would find flashing the files individually substantially easier coming from a pixel background
micheal2445 said:
Specifically CPH2459 A 07
Click to expand...
Click to collapse
CPH2459export_11_A.07_2022071521480000 - FirmwareX
firmwarex.net
What is the MSM applications username/password or auth code ?
It seems a lot more complicated my gn2200 had straight forward files people had posted but for this version I can't find the same.
I just googled the build #. Maybe not a good link, but just google it and you'll find it
I've been googling so far all mnm.exe or something and a file ending in .ofp
It's just my luck to get stuck in a boot loop, and have the model that seems to be fairly difficult to find partitions for my phone came with model CPH2459 QC 10812D not sure what additional information would be of use as it boot looped the day I received it which was software A0.7 or something along those lines, and I just need the boot a or b, vbmeta for the boot, system, and maybe vendor if this version also includes that as well as a super partition and modem for a and b I could flash. I can't use adb to load EDL and I cannot determine a way to do so with fastboot, or through the two-side button combination making the .ofp files I have found with ease difficult if not useless to practically fix my device. If anyone can either aid me to EDL mode, and explain how to load the ,ofp files, or provide the partitions I mentioned above I would be extremely grateful as I returned my gn2200 so I could get this model in the event I leave T-Mobile at any point in the future, and I am paying T-Mobile for talk, text, and data all of which I lack the capability to do at the moment.
I greatly appreciate that but cannot sign into my Telegram as my phone is in an unusable state. Is there any way you could use mega, or MediaFire? I would greatly appreciate it I have had to put off several vital calls due to this issue.