This guide is for people whose V20s are stuck in EDL mode or are otherwise unable to boot recovery, fastboot, or laf/download mode. You know if your device is in EDL mode if it does not react when you try to turn it on, and when plugged into a computer, it shows up as Qualcomm HS-USB QDLoader 9008, or some similar variation. If your phone can boot into recovery, fastboot, or laf/download mode, this guide is not for you.
Preface
I only have a VS995, so this guide has only been tested with that. However the firehose programmer I found said it was for a H918 so it will likely work for other variants. I performed these steps on Linux, but the tools used are written in Python and should work on Windows and MacOS too.
I take no responsibility if you mess up your phone doing this. Flashing over EDL is a very powerful process that can totally erase your phone's NAND if you're not careful. This process wil likely require a factory reset and you will likely lose all the data stored on the phone.
Prerequisites
Python 3 - Both tools used in this guide are written in Python 3
KDZTools - Used to extract partition images from KDZ files
Bjoern Kerler's EDL Utility - For flashing partition images in EDL mode
v20-root.zip from this XDA post - For the rooted aboot.img
A stock firmware KDZ - Can be obtained from lg-firmwares.com. I used VS99513A. Choose an appropriate KDZ for your device.
A screwdriver and a paper clip - Used to force the device into EDL mode
prog_ufs_firehose_8996_lite.elf - Firehose programmer file for use with the EDL utility
Since the firehose programmer is copyright LG, I cannot link to it as that would be unauthorized distribution of copyrighted work. It can be found online fairly easily though.
Preparation
1. Windows and MacOS: Download and install Python 3. Most Linux distros come with Python 3 already installed. To check, open a terminal/command window and type
2. Download and extract KDZTools to a directory of your choosing
3. Download and extract the EDL utility to a directory of your choosing and follow the setup instructions listed on its GitHub page
4. Download v20-root.zip and extract aboot.img into the directory you extracted the EDL utility into
5. Place your KDZ in the KDZTools directory and open a terminal/command window within that directory
6. Type
7. Type
8. Create seven folders within "dzextracted", named "lun0", "lun1", "lun2", etc
9. Move all the files prefixed with "B." into the folder titled "lun1", all the files prefixed with "C." into the folder titled "lun2", and so on. Move all the files that are not prefixed with any capital letter into the folder titled "lun0"
10. Rename all the files in each folder and remove the letter and the period from the filename. "E.modem_35910.bin" becomes "modem_35910.bin" for example
11. In the "lun0" folder, delete "userdata.bin"
12. In the command window, type
13. You should now have seven files titled "rawprogram#.xml" where # is a number from 0 to 6
14. Exit the KDZTools directory and go into the directory containing the EDL utility
15. Place the firehose programmer file into the folder named "Loaders"
16. Follow this iFixit guide up to Step 10 to gain access to your phone's motherboard.
Programming
1. Open a terminal/command window in the folder you extracted the EDL utility to. On Windows, you may need to open the command window as administrator. On MacOS and Linux, you will likely have to run the utility with sudo.
2. Type
If you get a message about missing Capstone and Keystone libraries, ignore it.
3. Put your phone's battery back in
4. Look for the following two pads on your phone's motherboard
If you can't see them, it's the pair of tiny pads just above the silver square with the H etched into it in the center of the image (Photo courtesy of runningnak3d)
5. Hold your paper clip or other conductive item on those two pads to short them out, then, while holding the paper clip in place, plug your phone into your computer. Keep holding the paper clip in place until you get an error about missing the firehose programmer from the EDL utility
6. Unplug your phone and remove the battery
7. In the message from the EDL utility, you should see a hardware ID and pkhash
8. Rename "prog_ufs_firehose_8996_lite.elf" to
9. Follow steps 2-5 again, but this time holding the paper clip in place until you see
10. In the terminal/command window, type
11. Type
12. Type
13. In the terminal/command window, type
14. Do step 13 again for each of the seven folders you created, replacing "0" in "rawprogram0.xml" and "lun0" with 1, 2, 3, 4, 5, and 6 as needed. This step will take some time
15. Once you have flashed all 7 "lun#" folders, type
16. Once complete, unplug your phone, remove the battery, reattach the backplate, and attempt to turn on the phone. It might boot to Android, but it might not. In my case, it did not boot to Android, but I could access fastboot and laf/download mode again, and I used those to finish fixing my phone.
Potential Problems
If you followed the guide and were able to restore your device to functioning order, but find that you have no signal and your phone reports it has no IMEI, type
Preface
I only have a VS995, so this guide has only been tested with that. However the firehose programmer I found said it was for a H918 so it will likely work for other variants. I performed these steps on Linux, but the tools used are written in Python and should work on Windows and MacOS too.
I take no responsibility if you mess up your phone doing this. Flashing over EDL is a very powerful process that can totally erase your phone's NAND if you're not careful. This process wil likely require a factory reset and you will likely lose all the data stored on the phone.
Prerequisites
Python 3 - Both tools used in this guide are written in Python 3
KDZTools - Used to extract partition images from KDZ files
Bjoern Kerler's EDL Utility - For flashing partition images in EDL mode
v20-root.zip from this XDA post - For the rooted aboot.img
A stock firmware KDZ - Can be obtained from lg-firmwares.com. I used VS99513A. Choose an appropriate KDZ for your device.
A screwdriver and a paper clip - Used to force the device into EDL mode
prog_ufs_firehose_8996_lite.elf - Firehose programmer file for use with the EDL utility
Since the firehose programmer is copyright LG, I cannot link to it as that would be unauthorized distribution of copyrighted work. It can be found online fairly easily though.
Preparation
1. Windows and MacOS: Download and install Python 3. Most Linux distros come with Python 3 already installed. To check, open a terminal/command window and type
python --version. It should say "Python 3.x.x"2. Download and extract KDZTools to a directory of your choosing
3. Download and extract the EDL utility to a directory of your choosing and follow the setup instructions listed on its GitHub page
4. Download v20-root.zip and extract aboot.img into the directory you extracted the EDL utility into
5. Place your KDZ in the KDZTools directory and open a terminal/command window within that directory
6. Type
python unkdz.py -f [NAME OF KDZ FILE].kdz -x and press enter. Once complete, you should have a "kdzextracted" folder containing a DZ file and a few other things. If you get an error about missing zstandard, type pip install zstandard and try again7. Type
python undz.py -f kdzextracted/[NAME OF DZ FILE].dz -s and press enter. Once complete, you should have a "dzextracted" folder containing a load of files8. Create seven folders within "dzextracted", named "lun0", "lun1", "lun2", etc
9. Move all the files prefixed with "B." into the folder titled "lun1", all the files prefixed with "C." into the folder titled "lun2", and so on. Move all the files that are not prefixed with any capital letter into the folder titled "lun0"
10. Rename all the files in each folder and remove the letter and the period from the filename. "E.modem_35910.bin" becomes "modem_35910.bin" for example
11. In the "lun0" folder, delete "userdata.bin"
12. In the command window, type
python undz.py -f kdzextracted/[NAME OF DZ FILE].dz -r13. You should now have seven files titled "rawprogram#.xml" where # is a number from 0 to 6
14. Exit the KDZTools directory and go into the directory containing the EDL utility
15. Place the firehose programmer file into the folder named "Loaders"
16. Follow this iFixit guide up to Step 10 to gain access to your phone's motherboard.
Programming
1. Open a terminal/command window in the folder you extracted the EDL utility to. On Windows, you may need to open the command window as administrator. On MacOS and Linux, you will likely have to run the utility with sudo.
2. Type
python edl.py printgpt --memory=ufs and press enter. You should see
Code:
Qualcomm Sahara / Firehose Client V3.2 (c) B.Kerler 2018-2021.
main - Trying with no loader given ...
main - Waiting for the device3. Put your phone's battery back in
4. Look for the following two pads on your phone's motherboard
If you can't see them, it's the pair of tiny pads just above the silver square with the H etched into it in the center of the image (Photo courtesy of runningnak3d)
5. Hold your paper clip or other conductive item on those two pads to short them out, then, while holding the paper clip in place, plug your phone into your computer. Keep holding the paper clip in place until you get an error about missing the firehose programmer from the EDL utility
6. Unplug your phone and remove the battery
7. In the message from the EDL utility, you should see a hardware ID and pkhash
8. Rename "prog_ufs_firehose_8996_lite.elf" to
[Hardware ID]_[PKHASH]_FHPRG.bin where [Hardware ID] is the hwid provided by the EDL utility, and [PKHASH] is the first 16 characters in the pkhash provided by the EDL utility9. Follow steps 2-5 again, but this time holding the paper clip in place until you see
Programmer uploaded successfully :). If all went well, you should see a list of partition names and a load of hexadecimal offsets and such. This means you've set everything up correctly10. In the terminal/command window, type
python edl.py r fsg fsg.bin --memory=ufs --lun=1 and hit enter. If you get "main - Waiting for the device", unplug your phone, remove the battery, and follow steps 3-5 again until you see Programmer uploaded successfully :)11. Type
python edl.py r modemst1 modemst1.bin --memory=ufs --lun=5 and hit enter.12. Type
python edl.py r modemst2 modemst2.bin --memory=ufs --lun=5 and hit enter. These three steps back up your EFS, which contains your phone's IMEI. We want a backup of this in case it gets corrupted by the flashing process. Your IMEI CANNOT be restored if EFS becomes corrupt and your phone will never be able to be activated on a cellular network again if we do not back up these three partitions first13. In the terminal/command window, type
python edl.py qfil "[PATH TO rawprogram0.xml]" "" "[PATH TO dzextracted/lun0]" --memory=ufs and press enter. Note that all the quotation marks are required.14. Do step 13 again for each of the seven folders you created, replacing "0" in "rawprogram0.xml" and "lun0" with 1, 2, 3, 4, 5, and 6 as needed. This step will take some time
15. Once you have flashed all 7 "lun#" folders, type
python edl.py w aboot aboot.img --memory=ufs --lun=416. Once complete, unplug your phone, remove the battery, reattach the backplate, and attempt to turn on the phone. It might boot to Android, but it might not. In my case, it did not boot to Android, but I could access fastboot and laf/download mode again, and I used those to finish fixing my phone.
Potential Problems
If you followed the guide and were able to restore your device to functioning order, but find that you have no signal and your phone reports it has no IMEI, type
python edl.py w fsg fsg.bin --memory=ufs --lun=1 and hit enter, then type python edl.py w modemst1 modemst1.bin --memory=ufs --lun=5 and hit enter, then type python edl.py w modemst2 modemst2.bin --memory=ufs --lun=5. These three commands will restore your EFS backup.
Last edited:
