[Guide]Unlock Bootloader for Noobs P769

Search This thread
By:
Advanced…
Alucai Vivorvel

Alucai Vivorvel

Senior Member
Oct 8, 2011
1,757
157
Hamilton
nhoc_maruko9x said:
No I'm using another carrier SIM and I still can unlock it. Actually the process is pretty simple, just so much time for download files (I didn't wait 30 mins before unlock).
Click to expand...
Click to collapse

What is the manufacture date of your battery? Take out the battery when it's powered off and check on the back. Mine for example says 2013.06.25(L) in a white field near the bottom. I believe it was devices whose batteries were made in June or later are of a different revision which locks the bootloader more securely. However, if yours was made in June or later, there may still be hope yet!



I've all since given up on ever unlocking the thing, especially since I got a different phone, but I'd be willing to try again. For science!
 
nhoc_maruko9x

nhoc_maruko9x

Senior Member
Oct 6, 2011
367
143
Hanoi
Google Pixel 4 XL
satyanand.kommoju said:
That's fantastic. The screen can be fixed rather easily i guess. Would you be able to provide an upload of x and u boot images from your device?
Click to expand...
Click to collapse

Yeah the screen fix is simple as well, I've just bought this L9 so it takes a while to read some topics :D And I think I must read more topics to know how to get x and u boot images :p

Alucai Vivorvel said:
What is the manufacture date of your battery? Take out the battery when it's powered off and check on the back. Mine for example says 2013.06.25(L) in a white field near the bottom. I believe it was devices whose batteries were made in June or later are of a different revision which locks the bootloader more securely. However, if yours was made in June or later, there may still be hope yet!



I've all since given up on ever unlocking the thing, especially since I got a different phone, but I'd be willing to try again. For science!
Click to expand...
Click to collapse

Mine is 2012.07.26; when I check IMEI on imei.info I get information:

Esndate: 20130307
Network: TMO
Esnoutgodate: 20130312

But it's earlier than June anyway.

At first, I run adb reboot oem-unlock from P769 ROM (V20H) but nothing happens, it just reboots. Then I flash V20B_00.kdz and screen goes crazy and mirrored (except LG logo at boot, it's still normal). After that, no 30-min wait, I run oem-unlock and yay, unlock screen appears, asks me to confirm, so I press Up volume button and everything is done.
 
S

satyanand.kommoju

Member
Mar 15, 2013
5
1
nhoc_maruko9x said:
Yeah the screen fix is simple as well, I've just bought this L9 so it takes a while to read some topics :D And I think I must read more topics to know how to get x and u boot images :p
Click to expand...
Click to collapse

use the following list of commands to get those images.

after connecting your device issue,

adb shell
dd if=/dev/block/mmcblk0p1 of=/sdcard/x-loader.img
dd if=/dev/block/mmcblk0p2 of=/sdcard/u-boot.img
Those two commands will dump the bootloader images to sdcard.

credits to @kuma82 for the commands.
 
Last edited:
  • Like
Reactions: hieuqu
Alucai Vivorvel

Alucai Vivorvel

Senior Member
Oct 8, 2011
1,757
157
Hamilton
nhoc_maruko9x said:
Yeah the screen fix is simple as well, I've just bought this L9 so it takes a while to read some topics :D And I think I must read more topics to know how to get x and u boot images :p











Mine is 2012.07.26; when I check IMEI on imei.info I get information:





Esndate: 20130307


Network: TMO


Esnoutgodate: 20130312





But it's earlier than June anyway.





At first, I run adb reboot oem-unlock from P769 ROM (V20H) but nothing happens, it just reboots. Then I flash V20B_00.kdz and screen goes crazy and mirrored (except LG logo at boot, it's still normal). After that, no 30-min wait, I run oem-unlock and yay, unlock screen appears, asks me to confirm, so I press Up volume button and everything is done.
Click to expand...
Click to collapse



Sorry for the late reply. That confirms it then, the unlock command will only work on devices made earlier than June 2013.
 
  • Like
Reactions: ish800
stunts513

stunts513

Senior Member
Feb 8, 2013
2,238
635
New Braunfels, TX
I kinda have to agree with that... I've been sticking to the kindle community because of this. Similar hardware and a bootloader exploit...

Sent from my Amazon Tate using Tapatalk
 
C

chris.domingo

New member
Jul 3, 2014
1
0
LG Recovery Installer

LaDY Vengeance said:
Uhhhhhhhgggg....why do I keep coming back to this damn forum. It's like looking inside an empty refrigerator hoping to find food.
Click to expand...
Click to collapse

Has any one tried LG Recovery Installer. It installs CWM Based Recovery 6.0.1.2 and seems to work on the lg p769 i haven't tried a CM Rom yet

would this also allow me to install a cyanogenmod custom rom
 
shinobisoft

shinobisoft

Recognized Contributor
Feb 18, 2012
3,299
3,413
Knoxville, TN
chris.domingo said:
Has any one tried LG Recovery Installer. It installs CWM Based Recovery 6.0.1.2 and seems to work on the lg p769 i haven't tried a CM Rom yet

would this also allow me to install a cyanogenmod custom rom
Click to expand...
Click to collapse
Yes, the recovery installer is known. It is for locked bootloader devices. The only way you'll be able to install CM or any other custom ROM is to first unlock your bootloader.
 
A

abby4625

New member
Jul 13, 2014
1
0
l9 p769 touch not working correctly after flashing to v20B

I flash the stoch v20b rom on my l9 p769, according to the video, after suceesfully flashing to v20B,i observed that the root permission has gone and also it does not boot into recovery. Then after that i reflashed to the stock rom 0f p769 which was v20h. The touch of the screen goes bad as it was on v20b. Is there any method to fix the screen touch. I am stuck badly on this, plz help
 
shinobisoft

shinobisoft

Recognized Contributor
Feb 18, 2012
3,299
3,413
Knoxville, TN
abby4625 said:
I flash the stoch v20b rom on my l9 p769, according to the video, after suceesfully flashing to v20B,i observed that the root permission has gone and also it does not boot into recovery. Then after that i reflashed to the stock rom 0f p769 which was v20h. The touch of the screen goes bad as it was on v20b. Is there any method to fix the screen touch. I am stuck badly on this, plz help
Click to expand...
Click to collapse

Download the V20F touchscreen fix by @kuma82 here
This must be flashed via custom recovery.
 
  • Like
Reactions: LaDY Vengeance
L

Lite2012

Member
May 10, 2014
42
3
help me plz :(

i have tried this method and all other methods to unlock my bootloader
i have a P768 and i successfully flashed P760 V20B KDZ on it
but i can't unlock the bootloader -_-
i follow the instructions correctly but when the phone reboots
no fastboot appears and it boots normally
what can i do ? i need to install a KK rom urgently :(
 
Cobra11Murderer

Cobra11Murderer

Senior Member
Oct 18, 2011
497
159
Mineral Wells
Lite2012 said:
i have tried this method and all other methods to unlock my bootloader
i have a P768 and i successfully flashed P760 V20B KDZ on it
but i can't unlock the bootloader -_-
i follow the instructions correctly but when the phone reboots
no fastboot appears and it boots normally
what can i do ? i need to install a KK rom urgently :(
Click to expand...
Click to collapse

im in the same boat.. and my phone was made in jan 2013.. idk what im doin wrong here.. i connected to wifi, tmobile sim installed, waited 45 mins.. did the command and boom reboot nothing else
 
C

Cdbarron727

Member
May 29, 2014
40
3
wow! thats a novel of a forum

I gave up my galaxy exhibit running Beanstalk to the wifey. Now I picked up this P76920h (4.1.2) from a friend and I come to find out that LG complied with making it a pain in the rear to unlock the bootloader on this thing.......without reading the 242 pages....is there a way that someone could let me know if this method does work..and if I do get it unlocked....will I be able to install a custom rom? Or am I just wasting my time?:confused:
 
shinobisoft

shinobisoft

Recognized Contributor
Feb 18, 2012
3,299
3,413
Knoxville, TN
Cdbarron727 said:
I gave up my galaxy exhibit running Beanstalk to the wifey. Now I picked up this P76920h (4.1.2) from a friend and I come to find out that LG complied with making it a pain in the rear to unlock the bootloader on this thing.......without reading the 242 pages....is there a way that someone could let me know if this method does work..and if I do get it unlocked....will I be able to install a custom rom? Or am I just wasting my time?:confused:
Click to expand...
Click to collapse

We've determined that the bootloader on any TMobile branded P769 made around March 2013 and newer IS NOT unlockable. Way to go TMobile. I myself, and several others, have moved on the the L90, which is slightly better than the L9 and it's bootloader IS unlockable :D
There are some themed ROMs for the L9's with locked bootloaders and there are a couple 2nd-init recoveries too. If you do manage to get it unlocked then you'll be able to pretty much do whatever you want with the device. ROMs, kernels, recoveries. Best of luck :)
 
C

Cdbarron727

Member
May 29, 2014
40
3
Thanks for the response...I'll give up on it being that it wouldn't be something that I would even be capable of figuring out...at least I have titanium backup and was able to de-bloat......any way to increase internal storage with an app like A-parted? (That's what I did with my exhibit)...,I'd rather improve it the best I can until I get a new one: -)

Sent from my LG-P769 using XDA Free mobile app
 
You must log in or register to reply here.

Similar threads

mingkee
temporary LG L9 (P760 and P769) rooting/Q&A/accessories thread
Replies
1K
Views
350K
L
lecorbusier
cmahendra
[GUIDE] [UNBRICK][ROOT] FLASH Any LG L9 Factory ROM (kdz) WITH OFFLINE FIX
Replies
1K
Views
655K
C
cgigate
A
[TUTORIAL] ROOT LG Optimus L9 - EASY! (P760,P765,P768,P769)
Replies
141
Views
211K
S
SHAOLIN.DRAGON
L
[fastboot] l9 p760 p765 p768 p769
Replies
83
Views
170K
R
rethus
cmahendra
[2in1GUIDE][JB] Unlock Bootloader and FASTER Root L9 Method
Replies
295
Views
189K
A
app freak

Top Liked Posts

24 Hours All time
  • There are no posts matching your filters.
  • 62
    carloswii5
    carloswii5
    Ok So Here Is The Link Might Say Still Uploading Depending The Time Your Reading I Will Post The Files I Use Tomorrow And Remember A Thumbs Up Both Here And On The Video Would Be Appreciated (; Good Luck :)

    http://www.youtube.com/watch?v=WyNtFP_TkKc&feature=youtu.be


    V20B Root Bin
    https://drive.google.com/uc?id=0B059sYrh0T19S1hfN25fdnVUVWs&export=download
    Files That Go On SD Card
    https://docs.google.com/viewer?a=v&pid=explorer&srcid=0B059sYrh0T19RWFYcERIQVVoSkU
    Root Guides
    https://docs.google.com/viewer?a=v&pid=explorer&srcid=0B059sYrh0T19R1NPUkZEc240U0k
    USB Driver And Text File Describing Locations
    https://docs.google.com/viewer?a=v&pid=explorer&srcid=0B059sYrh0T19V1JSS0hNUWpDRnc
    V20B KDZ
    Wasn't Able To Upload Can Anyone Help Me out with this one? still struggling with internet problems...

    All The Files In One Zip
    Thank You ggfool
    https://mega.co.nz/#!ElNxlS4C!Ko_1FSI68loOrkrQdYNutDqkQ2QHRX9vPe7MyXrkqNM

    *OLD TUTORIAL*


    Warning Just to let you know that this will Void your warranty you should already know that 

    Also this may look really long but its short just somewhat really specific 

    Hello Fellow Optimus L9 Users today I Bring you a tutorial on how to unlock bootloader the noob version for those who are new to rooting and stuff because there is another one that is more complicated and less specific but if you want to check it out heres
    the link http://forum.xda-developers.com/showthread.php?t=2198114

    Okay First to let you know that when you flash V20B_00.kdz the screen will get kind
    of funky everything will be inverted and backwards so dont worry. And one more thing is
    that when you boot up every single time after doing this the boot will be mirrored. Just
    to let you know.


    First Just want to thank "pinoyto" "Lelus" and "cmahendra"
    Okay Now to Start Download the zip containing the files link here https://www.dropbox.com/s/uxwvkkp8yyyev0k/Bootloader Unlock .zip Files contained
    in the zip are "Adb" "Recovery image" "V6.bin" and "V20_00.bin"
    After youve downloaded extract the files to a folder for later use.

    Now before we go to flash the V20.kdz enable "usb debugging"

    Now go flash the kdz with this tutorial http://forum.xda-developers.com/showthread.php?p=36351786

    1)Now after you've flashed then comes the screen problem just unlock and go throught the setup quickly

    2) Connect your usb and make sure the usb debbuging icon pop-ups the little spider looking thing if thats enabled good

    3) Okay next im not really sure if its needed but just do it change the usb
    entrance to "LG Software Mode" to do this the simple way you need to disconnect usb and
    connect again after than the options appear what type of usb entrance click on the back arrow
    and it should select the "LG Software Mode"

    4) Now we want to connect to the WiFi THIS IS NECESSARY FOR IT TO WORK go and connect to it
    after that make sure you are connected by opening the browser or youtube and if a page or
    video loads your set now go make yourself a coffee or some thing because now you have to wait
    30 or more minutes

    5) Ok now that the 30 minutes or more have passed you need to go to the downloaded files and move
    the "Android" folder to your "C:\" drive "dont worry just has adb files" now open a command prompt and
    type the following
    "cd c:\Android"
    "adb devices" to make sure your phone is connected a list of numbers should appear
    "adb reboot oem-unlock" and your phone should then reboot
    then the lg logo will appear then a mirrored confirmation to unlock bootloader just press
    the "Volume Up" button and it will confirm it then hold the power button until it reboots

    6) Now we need to go to "rooted 10g" again just go here http://forum.xda-developers.com/showthread.php?t=2173465
    and follow every single instruction but when you are about to enter the flashing process instead
    of "Emergency" mode you need to put it to "Diag" mode and then start the flashing process

    7) After you are done with that you cant boot so you must perform a wipe and the way of doing that
    is too have phone off hold "Power button + Volume Down + Home Button" then you should see
    a android with the little globe and a loading bar after its done it will turn off then
    now reboot and after it boot it will be mirrored you can fix that but in my opinion it is a little more confusing
    because the screen is still messed up the whole left side is inverted with the right side but if you still want to remove the mirror
    you must press the power button once to turn off screen then again to turn on and it will be fixed but the touch is still inverted

    8) Now go through setup and enable usb debugging and then u need to go to the superuser app
    and if you dont have it you did not do the root process correctly go to it again "and if you need help just pm me"
    open the app and update the binary after that go to your computer and open command promt again
    and enter the following commands but before you must put the v6.bin file to your external sd card it is in the downloaded files after you have put it to the root
    of your external sd card enter the following commands
    "cd c:\Android"
    "adb shell"
    "su" when you enter this go to your phone and accept the su request
    "cat /sdcard/external_sd/v6.bin > /sys/devices/virtual/input/lge_touch/firmware"
    after you entered the last command you need to close that command promt and open
    another one and type the following commands
    "cd c:\Android"
    "adb shell"
    "su"
    "reboot" then it will reboot and the touch will corectly work remember the mirrored problem will continue
    to occur on your phone like i said just turn off screen then turn it on and it will be fixed
    Now you have unlocked bootloader 
    If you want to install the cm10 rom the optimus L9 has as of right now you
    have to do the following

    1) Go to the app store and search for the app called "Nandroid Manager ROOT"
    download the app and open it then go to flash recovery you must first put the recovery from the downloaded file to the
    root of you external sd card and then go to the app and search for the recovery and flash it.
    After you flash it you will have a recovery on your phone
    (just to let you know it will be mirrored) but to boot to recovery you must turn off the phone
    and then hold the "Volume UP + Home Button + Power Button"
    now go download the cm10 rom from here " http://forum.xda-developers.com/showthread.php?t=2216542 " put the file to the root of your sd card and then reboot to recovery and then to flash you will need to "wipe system, wipe cache, and wipe dalvik cache then flash" after you flash the zip reboot and you will have CM10 Hope This helped :D

    -Credits to geeshiet for still having a copy of my guide Thank You geeshiet
    View
    12
    S
    shutt1e
    hello folks, seem not quite easy, i got big headache to load the bootloader into ida, looks like omap processors use different addesses, while the good old msm7x30 was reading the bootloader at location 0 the omap don't. To get the bootloader show in ida i have had to load it twice at two memory locations, first one is at 0x9d000000 and the second at 0x9e000000. dunno really if this approach is correct but using this trick i can see all the text stings correctly extracted by ida.
    Bootloader code on E730 was much more straightforward, this one use some tricks that make (at least for me) impossible to guess what is the next instruction to execute.
    If i guessed the labels correctly, the most interesting part of the bootloader is this one


    RAM:9D0133FC boot_main ; CODE XREF: RAM:9D01393Cp
    RAM:9D0133FC
    RAM:9D0133FC var_978 = -0x978
    RAM:9D0133FC var_180 = -0x180
    RAM:9D0133FC var_174 = -0x174
    RAM:9D0133FC var_EC = -0xEC
    RAM:9D0133FC
    RAM:9D0133FC STMFD SP!, {R4-R6,LR}
    RAM:9D013400 MOV R3, 0x9CFFFFFF
    RAM:9D013404 SUB SP, SP, #0x970
    RAM:9D013408 MOV R5, R0
    RAM:9D01340C LDR R4, [R3,#-0x357]
    RAM:9D013410 BL sub_9D014958
    RAM:9D013414 CMP R0, #1
    RAM:9D013418 BNE MmcInitFail_bootimg
    RAM:9D01341C MOV R0, asc_9D03096C ; "======================================="...
    RAM:9D013424 BL Print_on_screen
    RAM:9D013428 MOV R0, asc_9D03096C ; "======================================="...
    RAM:9D013430 BL Print_on_screen
    RAM:9D013434 MOV R0, aFotaProcessLk ; " FOTA process LK\n"
    RAM:9D01343C BL Print_on_screen
    RAM:9D013440 MOV R0, asc_9D03096C ; "======================================="...
    RAM:9D013448 BL Print_on_screen
    RAM:9D01344C MOV R0, asc_9D03096C ; "======================================="...
    RAM:9D013454 BL Print_on_screen
    RAM:9D013458 MOV R1, #0x9C8
    RAM:9D01345C MOV R0, R4
    RAM:9D013460 MOVT R1, #0x9D03
    RAM:9D013464 BL sub_9D0175D4
    RAM:9D013468 SUBS R3, R0, #0
    RAM:9D01346C BEQ NoFotaPart
    RAM:9D013470 MOV R1, #0x9F4
    RAM:9D013474 MOV R0, R4
    RAM:9D013478 MOVT R1, #0x9D03
    RAM:9D01347C LDR R6, [R3,#0x10]
    RAM:9D013480 BL sub_9D0175D4
    RAM:9D013484 CMP R0, #0
    RAM:9D013488 BEQ NoFotaUboot
    RAM:9D01348C LDR LR, [R0,#0x14]
    RAM:9D013490 MOV R12, unk_9D126788
    RAM:9D013498 ADD R3, SP, #0x980+var_180
    RAM:9D01349C ADD R0, R3, #8
    RAM:9D0134A0 ADD R6, R6, LR,LSR#9
    RAM:9D0134A4 STR R6, [R12]
    RAM:9D0134A8 BL mmcReadErrLoadFOTAUSD
    RAM:9D0134AC LDR R2, [SP,#0x980+var_174]
    RAM:9D0134B0 MOV R1, 0xF0F85EFE
    RAM:9D0134B8 ADD R0, R2, R1
    RAM:9D0134BC CMP R0, #2
    RAM:9D0134C0 BHI boot_linux_emmc
    RAM:9D0134C4 LDR R0, [SP,#0x980+var_EC]
    RAM:9D0134C8 CMP R0, #0x1A
    RAM:9D0134CC BEQ boot_linux_emmc
    RAM:9D0134D0 MOV R0, asc_9D03096C ; "======================================="...
    RAM:9D0134D8 BL Print_on_screen
    RAM:9D0134DC MOV R0, aGotoRecoveryForF ; " Goto recovery for FOTA up"...
    RAM:9D0134E4 BL Print_on_screen
    RAM:9D0134E8 MOV R0, asc_9D03096C ; "======================================="...
    RAM:9D0134F0 BL Print_on_screen
    RAM:9D0134F4 MOV R0, unk_9D02E694
    RAM:9D0134FC BL Print_on_screen
    RAM:9D013500 MOV R1, #0xA50
    RAM:9D013504 MOV R0, R4
    RAM:9D013508 MOVT R1, #0x9D03
    RAM:9D01350C BL sub_9D0175D4
    RAM:9D013510 CMP R0, #0
    RAM:9D013514 BEQ NoKernPart
    RAM:9D013518 LDR R6, [R0,#0x10]
    RAM:9D01351C MOV R0, aToRecoveryLu ; " to recovery [%lu]!\n"
    RAM:9D013524 MOV R1, R6
    RAM:9D013528 BL Print_on_screen
    RAM:9D01352C
    RAM:9D01352C Secure_Boot ; CODE XREF: boot_main+3F0j
    RAM:9D01352C MOV R4, #0x678C
    RAM:9D013530 MOV R0, R5
    RAM:9D013534 MOVT R4, #0x9D12
    RAM:9D013538 MOV R1, R6
    RAM:9D01353C MOV R2, R4
    RAM:9D013540 MOV R3, #0x200
    RAM:9D013544 BL read_block_from_mmc
    RAM:9D013548 CMP R0, #1
    RAM:9D01354C BNE FailToLoadBootHdr
    RAM:9D013550 MOV R1, #0xB10
    RAM:9D013554 MOV R0, R4
    RAM:9D013558 MOVT R1, #0x9D03
    RAM:9D01355C MOV R2, #8
    RAM:9D013560 BL chk_magic
    RAM:9D013564 CMP R0, #0
    RAM:9D013568 BNE Bad_magic
    RAM:9D01356C LDR R12, [R4,#0x24]
    RAM:9D013570 MOV R0, R5
    RAM:9D013574 LDR R2, [R4,#0xC]
    RAM:9D013578 LDR R3, [R4,#8]
    RAM:9D01357C ADD R6, R6, R12,LSR#9
    RAM:9D013580 MOV R1, R6
    RAM:9D013584 BL read_block_from_mmc
    RAM:9D013588 CMP R0, #1
    RAM:9D01358C BNE FailToLoadKernel
    RAM:9D013590 LDR R1, [R4,#0x24]
    RAM:9D013594 MOV R0, R5
    RAM:9D013598 LDR LR, [R4,#8]
    RAM:9D01359C LDR R2, [R4,#0x14]
    RAM:9D0135A0 RSB R12, R1, #0
    RAM:9D0135A4 LDR R3, [R4,#0x10]
    RAM:9D0135A8 ADD R1, R1, LR
    RAM:9D0135AC SUB R1, R1, #1
    RAM:9D0135B0 AND LR, R1, R12
    RAM:9D0135B4 ADD R6, R6, LR,LSR#9
    RAM:9D0135B8 MOV R1, R6
    RAM:9D0135BC BL read_block_from_mmc
    RAM:9D0135C0 CMP R0, #1
    RAM:9D0135C4 BNE FailToLoadRamDSK
    RAM:9D0135C8 BL sub_9D0076C0
    RAM:9D0135CC MOV R1, R0
    RAM:9D0135D0 MOV R0, BeforeSecureBoot ; "before secure booting - current time: %"...
    RAM:9D0135D8 BL Print_on_screen
    RAM:9D0135DC BL sub_9D017D8C
    RAM:9D0135E0 MOV R0, SecureBootStart ; "Secure boot started\n"
    RAM:9D0135E8 BL sub_9D015E84
    RAM:9D0135EC MOV R0, asc_9D02FC70 ; "---------------------------------------"...
    RAM:9D0135F4 BL Print_on_screen
    RAM:9D0135F8 MOV R0, InfoLge_security ; "INFO: LGE_SECURITY boot is started~!!!\n"...
    RAM:9D013600 BL Print_on_screen
    RAM:9D013604 LDR R1, [R4,#0x24]
    RAM:9D013608 MOV R0, R5
    RAM:9D01360C LDR LR, [R4,#0x10]
    RAM:9D013610 ADD R2, SP, #0x980+var_978
    RAM:9D013614 MOV R3, #0x800
    RAM:9D013618 RSB R12, R1, #0
    RAM:9D01361C ADD R1, R1, LR
    RAM:9D013620 SUB LR, R1, #1
    RAM:9D013624 AND R1, LR, R12
    RAM:9D013628 ADD R1, R6, R1,LSR#9
    RAM:9D01362C BL read_block_from_mmc
    RAM:9D013630 CMP R0, #1
    RAM:9D013634 BEQ bootImgSignature
    RAM:9D013638 MOV R0, #0xC14
    RAM:9D01363C MOV R5, #0x4E1F
    RAM:9D013640 MOVT R0, #0x9D03
    RAM:9D013644 BL Print_on_screen
    RAM:9D013648 MOV R0, CannotReadCertImg ; "CANNOT READ CERTIFICATION IMAGE\n "
    RAM:9D013650 BL Print_on_screen
    RAM:9D013654 MOV R0, #2
    RAM:9D013658 BL sub_9D00F4E0
    RAM:9D01365C MOV R12, #0xE29C
    RAM:9D013660 MOV R0, #0xA600
    RAM:9D013664 MOVT R12, #0x9D12
    RAM:9D013668 MOVT R0, #0x9D0C
    RAM:9D01366C LDRH R2, [R12]
    RAM:9D013670 MOV R1, #0x87000000
    RAM:9D013674 LDRH R3, [R12,#2]
    RAM:9D013678 MUL R2, R2, R3
    RAM:9D01367C BL sub_9D001994
    RAM:9D013680 MOV R0, #2
    RAM:9D013684 BL sub_9D00F53C
    RAM:9D013688
    RAM:9D013688 loc_9D013688 ; CODE XREF: boot_main+2A8j
    RAM:9D013688 SUB R5, R5, #1
    RAM:9D01368C MOV R0, #0x3E8
    RAM:9D013690 BL sub_9D00760C
    RAM:9D013694 SUB R5, R5, #1
    RAM:9D013698 MOV R0, #0x3E8
    RAM:9D01369C BL sub_9D00760C
    RAM:9D0136A0 CMN R5, #1
    RAM:9D0136A4 BNE loc_9D013688
    RAM:9D0136A8 MOV R0, #7
    RAM:9D0136AC BL sub_9D0058BC
    RAM:9D0136B0
    RAM:9D0136B0 bootImgSignature ; CODE XREF: boot_main+238j
    RAM:9D0136B0 LDR R0, [R4,#0xC]
    RAM:9D0136B4 ADD R12, SP, #0x980+var_978
    RAM:9D0136B8 LDR R1, [R4,#8]
    RAM:9D0136BC MOV LR, #0x400
    RAM:9D0136C0 LDR R2, [R4,#0x14]
    RAM:9D0136C4 LDR R3, [R4,#0x10]
    RAM:9D0136C8 STMEA SP, {R12,LR}
    RAM:9D0136CC BL sub_9D017DBC
    RAM:9D0136D0 CMP R0, #0
    RAM:9D0136D4 BNE NoBootImgSign
    RAM:9D0136D8
    RAM:9D0136D8 secure_boot_end ; CODE XREF: boot_main+494j
    RAM:9D0136D8 BL sub_9D0076C0
    RAM:9D0136DC MOV R1, R0
    RAM:9D0136E0 MOV R0, AfterSecureBoot ; "after secure booting - current time: %l"...
    RAM:9D0136E8 BL Print_on_screen
    RAM:9D0136EC MOV R0, SecureBootEnd ; "Secure boot End\n"
    RAM:9D0136F4 BL sub_9D015E84
    RAM:9D0136F8 MOV R0, #0xCDC
    RAM:9D0136FC LDR R1, [R4,#0xC]
    RAM:9D013700 LDR R2, [R4,#8]
    RAM:9D013704 MOVT R0, #0x9D03
    RAM:9D013708 BL Print_on_screen
    RAM:9D01370C MOV R0, #0xCF4
    RAM:9D013710 LDR R2, [R4,#0x10]
    RAM:9D013714 LDR R1, [R4,#0x14]
    RAM:9D013718 MOVT R0, #0x9D03
    RAM:9D01371C BL Print_on_screen
    RAM:9D013720 LDR R1, [R4,#8]
    RAM:9D013724 LDR R0, [R4,#0xC]
    RAM:9D013728 BL sub_9D013D14
    RAM:9D01372C MOV R0, aKernelIsNotChang ; "Kernel is not changed. Starting kernel."...
    RAM:9D013734 BL Print_on_screen
    RAM:9D013738 MOV R0, unk_9D12678C
    RAM:9D013740 BL starting_kernel
    RAM:9D013744 MOV R0, aBootKernelFailed ; "boot kernel failed!\n"
    RAM:9D01374C BL Print_on_screen
    RAM:9D013750 MOV R0, #0

    so, apparently, the code in bold, make the code jump if the img signature is missing or tampered. Nopping the BNE make it to skip the check at all, seem so easy but.....
    altering a bootloader is a risky thing. if there is somewhere an integrity check or if the patch is wrong, it could lead on an hard bricked device. i have hard bricked mine once and i was lucky to revive it, i know how to reflash a dead E730, but i know nothing about an L9.
    i will include on this post the ida .idb file, so maybe someone else skilled on arm asm can read it and suggest another/better way.
    I can patch the bootloader easily but i want you know what the tester (i can't test because i don't have the device) is risking.
    View
    10
    S
    shutt1e
    LaDY Vengeance said:
    Ok. I just sent him the database and @shinobisoft x-loader. ;)

    Sent from my LG-P769 using XDA Premium 4 mobile app
    Click to expand...
    Click to collapse


    i just managed to load into ida the x-loader at the correct address and filled some labels.

    there are some interesting part of code regarding signature check. dunno if he can post here, but i'd like to share with him some thoughts.

    here is the x-boot dissamble, Base Address: 40304350h - 40360A00h just a insane mind at Ti could choose an address like that.
    View
    9
    carloswii5
    carloswii5
    Gonna upload a updated video hopefully that fixes everyone's problems...

    Sent from my LG-P769
    View
    9
    LaDY Vengeance
    LaDY Vengeance
    Shutt1e needs more time. He debugged some of it and realized that it will take a bit more time. Just wanted to keep you guys updated.

    Sent from my LG-P769 using XDA Premium 4 mobile app
    View

New posts