[GUIDE] Official LG G6 Bootloader Unlock (Currently supported: EU H870, USA US997)

Search This thread
Last edited:


Dec 12, 2020
I have an idea!

We should be able to obtain (temporary) root by exploits (maybe this?: CVE : 2019-2107), and install twrp from OS.
I have done that on android 4.2? or 4.4
But i have no clue how to do that on android 7,8 or 9.

Because the only thing we need is TWRP on recovery partition.
We unlock bootloader to install TWRP by "fastboot flash recovery(?) (something)"
AND after that install (most often) Magisk.

When we obtain root by some exploit or something, we should be able to install twrp without need to unlock BL
Interesting, I'm not sure how it could be pulled off, because i'm not skilled with that sort of thing. Maybe you should try, you did say you had experience
there is even a change.org petition (5 years old) to give out keys, but we're still on square one
I am sure many people would really appreciate if we get a workaround at least - so, WojtekCC, if you could test the suggested approach it would be awesome !
We unlock bootloader to install TWRP by "fastboot flash recovery(?) (something)"
AND after that install (most often) Magisk.

When we obtain root by some exploit or something, we should be able to install twrp without need to unlock BL


Dec 12, 2020
On my G6 the Android security patch level is May 1, 2019. That should mean 2019-2107 should work since it was found in ~July 2019, right?
Probably, there is only one way to find out.

How did you do it? Do you have a link to the video/software you used ?
Cause the inplmentation would be the same, the only thing that would change would be the files used!
I dont think it even counts because I used farmaroot for some oldish phone.

I would test it myself but i have to sell few things and maybe buy some lg phone from some marketplace.


Mar 26, 2017
Probably, there is only one way to find out.

I dont think it even counts because I used farmaroot for some oldish phone.

I would test it myself but i have to sell few things and maybe buy some lg phone from some marketplace.
Hmm. Farmaroot doesn't seem to be open source. It did support some older lg devices but i don't think the security was in any way the same. It does use a video exploit and maybe by unpacking it and editing the source video and payload we could boot into twrp, or more unlikely, install magisk.

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    I didnt say I have experience. I said I have done it once on android 4.

    On android 7-9 should be doable.
    How did you do it? Do you have a link to the video/software you used ?
    Cause the inplmentation would be the same, the only thing that would change would be the files used!
  • 76
    The LG G6 H870 for the European market and the USA carrier-free US997 can now be officially unlocked through LG's developer unlock program.
    Your H870 is from outside Europe? You have a H871/2/3/etc or H870K/DS/etc? That's not a European H870, won't work. Your US997 tied to a carrier? Won't work.

    Please read the FAQ and use the thread search feature before asking questions.

    This thread is a work in progress and actively being updated.

    LG Developer Unlock Site Here

    • European LG G6 H870 or USA carrier-free US997
    • Computer w/ADB & Fastboot. ADB/Fastboot for Windows here. ADB/Fastboot for Linux/OS X here.
    • Basic knowledge of ADB, Fastboot and Windows command prompt or Linux/OS X terminal.
    • Device IMEI. This 15-digit code can be found on your box, the settings menu or by dialing *#06#
    • LG developer account -- sign up for free by clicking the "Start Unlocking the Bootloader" button at the bottom of the LG site HERE.

    LG's official bootloader unlock directions can be found here but I've still rewritten the steps out below while revising some things and also adding steps for TWRP and root.

    1. Enable USB-Debugging on your phone. USB-Debugging is required for the adb commands to work. To enable USB-Debugging, go to Settings >> About phone >> Software info and tap Build number until it says you are now a developer. Return to the previous screen, select Developer Options and enable USB-Debugging (this option may be greyed out if you have your USB cable plugged into your phone).

    2. Enable OEM unlock on your phone. To enable OEM unlock, go to Settings >> Developer options and toggle/turn on Enable OEM Unlock.

    3. Open CommandPrompt or Terminal and enter the following ADB command to reboot into the bootloader:
    adb reboot bootloader
    If ADB is not detecting your device try switching your phone's USB mode from Charging to MTP or PTP. If using Windows please make sure you've installed LG's USB drivers. You can download them HERE.

    Alternatively, you may be able to boot into fastboot without ADB by powering off the phone then power the phone on while holding Volume UP (USB cable will need to be removed otherwise it may boot into LG Download Mode)

    4. Once in the bootloader, use the following fastboot command to obtain Device ID:
    fastboot oem device-id
    Fastboot command will return a string. This is the Device ID which is needed to generate your unique unlock key.
    Example :
    $ fastboot oem device-id
    (bootloader) Device-ID
    (bootloader) CD58B679A38D6B613ED518F37A05E013
    (bootloader) F93190BD558261DBBC5584E8EF8789B1

    To generate your unlock key, you will need to paste together the 2 lines of output into one continuous string without "(bootloader)" or spaces. In the example above, the Device ID would be:


    5. Copy Device ID and IMEI into the LG Developers Bootloader Unlock site and hit the confirm button. In a few moments the unlock.bin will be emailed to you. Download unlock.bin to computer.

    6. While the phone is still in fastboot enter the following command to unlock the bootloader:
    This will unlock your bootloader AND factory reset your device wiping all data!
    You can use the LG Backup app or LG Bridge to backup and restore your data before unlocking the bootloader.

    fastboot flash unlock unlock.bin

    7. You can now reboot the phone and boot into your bootloader unlocked device! Enter:
    fastboot reboot

    8. Want TWRP or root?
    For TWRP you will need to download the TWRP H870 image. Current unofficial TWRP build is available HERE. (thanks to @Rashed97)
    For root you will need to download either SuperSU or Magisk and then flash either of the zips using TWRP.

    Reboot back into the bootloader
    adb reboot bootloader
    (you'll have to first re-enable USB debugging since data was wiped after the bootloader unlock)

    or power off again.. unplug the USB cable then power on the phone while holding Volume UP.

    9. Flash TWRP:
    fastboot flash recovery twrp.img

    After flashing TWRP unplug the USB cable and power off the phone (hold volume down + power button).. continue holding until phone reboots...
    As soon as you see the LG logo on the screen.. let go of the power button then quickly press it again (never letting go of volume down).
    Keep holding until you see the Factory Reset screen. Click thru the factory reset screens using the volume buttons to move up/down and power button to select. Choose "Yes" twice until it boots into TWRP. Despite what the screen says it won't actually factory reset/wipe your data... as long as you've installed TWRP. If stock recovery is installed it WILL wipe data.

    For TWRP to "stick" you must 1st boot into TWRP and not boot back into Android until after doing one of the following...

    10. Now you can flash your root zip of choice.

    Feel free to back up first.. but otherwise.. time to install SuperSU/Magisk. Reboot into system when finished.

    Have fun and be careful.

    Q: I have an H870 but it is not a European H870... can I unlock the bootloader?
    A: No, this official unlock program is ONLY for the H870 model for countries in Europe just like LG did for the LG G4 and G5.
    But... for about a 10 day span G4 devices from SE Asia worked with the official site and users received unlock.bin files.. despite that variant never showing up on the supported list. So you never know what can happen until you try and submit your device-id/IMEI into the LG Developer Bootloader Unlock site. :good:

    Q: Will more devices be added?
    A: Impossible to say what will happen in the future.. we must wait and see. The LG G5 bootloader unlock program was originally only open to the European H850 but months later the H840 G5SE and the USA RS988 G5 were added to the program.

    Q: I can't get my phone to show up with ADB or Fastboot, watdo?
    A: Make sure ADB/Fastboot is properly setup for your OS... udev rules setup in Linux.. LG USB drivers installed for Windows... OS X/MacOS just works. Also, confirm USB debugging is enabled.
    ADB still not working?... try changing the phones USB modes.. from maybe charging to MTP.. or MTP to PTP.

    Q: What happens to warranty if I unlock or root?
    A: YMMV I suppose. The official LG site claims that warranty is void if damage is caused by the unlock. On the T-Mobile G6 there is now a bootloader unlock counter. I will assume this counter is also on the H870/US997, so it will be hard to hide the fact that you unlocked the bootloader. Please share any unlocked bootloader LG G6 warranty replacement stories in this thread.

    Q: Can I re-lock the bootloader?
    It IS possible to re-lock the bootloader with the the command: fastboot oem lock
    You'll have to boot back into the bootloader (adb reboot bootloader) to issue the fastboot command.
    Re-locking the bootloader WILL wipe data just like the unlock process. Use LG Backup app/LG Bridge or another backup method first if you want your data.
    Flashing a KDZ in LGUP or LG Bridge will NOT relock the bootloader.

    DO NOT re-lock the bootloader if you have a modified boot/system img... restore them to stock first or you will not be able to boot into android after the lock and need to flash a KDZ in download mode.

    Q: So many words... yudodat?
    A: Here is a video on how to unlock the G4... up until the 6minute mark it is step-by-step 100% the same as G6. Only slight difference is when you get to the TWRP/root steps. https://www.youtube.com/watch?v=O64GfQORCaE

    y u quote OP?

    Follow me on twitter for future updates on LG-related things - twitter.com/@utoprime

    Find this thread helpful? Hit the Thanks button!
    Feeling extra generous? Consider donating to me.
    I'm building TWRP for you guys right now
    @Rashed97 has put together some new TWRP images that have data mounting and data decryption working.


    It is recommended to now use these TWRP builds until they are officially available on TWRP.me
    Thanks autoprime, keeping an eye out for us G6 owners in the rootless wasteland ☺

    (As a VS988 owner I know I'm really stuck in purgatory, but can always hope ? It was time to finally upgrade from my G3 - you did awesome work on that phone, hugely appreciated by many.)

    was really hyped to see this thread, only to discover that the model i won in a raffle is the (Amazon sourced) 64GB, H870! device arrives today and i suspect it's probably the H870DS...
    You probably won't be able to unlock the Bootloader unfortunately...

    I'm starting a petition to LG to enable Bootloader on all LG Smartphones, so we can get thousands of signatures from all models/variants owners!!

    Sent from my LG-H870 using Tapatalk