[Guide]Unlock Bootloader for Noobs P769

Search This thread


New member
Mar 12, 2013
My tmobile p769 was produced march 1, 2013. Should i even attempt this?

Sent from my LG-P769 using XDA Free mobile app


Senior Member
Oct 18, 2011
Mineral Wells
The unlocking process requires flashing older kdz files. However it most likely wont work with the p769. Like I said earlier, if you have a bunch of free time...

Sent from my LG-D415 with Tapatalk

I dont get it.. why is it that the L90 is unlocked and yet this phone is such a pain in the ace to do.. my avant will be in today praise the lord! lol but still it angers me that the L9 is such a hard ace


Recognized Contributor
Feb 18, 2012
Knoxville, TN
I dont get it.. why is it that the L90 is unlocked and yet this phone is such a pain in the ace to do.. my avant will be in today praise the lord! lol but still it angers me that the L9 is such a hard ace
I don't get it either. I gave up on the L9, tho I still have it as a backup phone, and moved on to the L90 even tho I swore I wouldn't buy another LG device after the issues with the L9. It may be that with all the questions about the bootloader on the L9 that LG and T-Mobile decided to leave the bootloader alone, on the US variant (D415) of the L90.

What I don't understand is why they want so much control over the devices they sell, especially the pre-paid market. My L9 cost me $200 out right because I don't do contract service plans. I should have full rights to the device. No different than a computer. I can understand in the short term for contract service, but for pre-paid service??

Rant over... for now! Lol

Sent from my LG-D415 with Tapatalk


Senior Member
Aug 17, 2013


i think i may have found something that can help us

To break disk encryption, the bootloader must be unlocked before the attack because scrambled user partitions are wiped during unlocking. However, we show that cold boot attacks are more generic and allow to retrieve sensitive information, such as contact lists, visited web sites, and photos, directly from RAM, even though the bootloader is locked.

I mean anything's possible. At this point it's either brute-force or something like this.

---------- Post added at 06:44 PM ---------- Previous post was at 06:19 PM ----------

A port of this would also be interesting: http://unlimited.io/jbhboots.htm
Last edited:


Senior Member
Feb 5, 2014
It should but you don't need to worry about a touch screen fix or smoky touch screen cause the p760 and p765 are identical. You only need to flash the p760 20b kdz and then run the unlock command

Sent from my LG-P769 using XDA Free mobile app


New member
Oct 6, 2014
pretty new to this

Ok ive tried all three with my rooted lg l9 p769 ....link2sd only saved me a little space not enough to make a big difference ,directory bind i couldmt figure out what to do fory specific device ,ext2sd worked great but i still get the insuficiant storage message one i hit my 2g internal cap any suggestions


New member
Mar 2, 2015
help please

When this in the review process , to the point that checks the battery my stop .Diz that the battery is low , and this fully charged. Do you know why that?


New member
Mar 28, 2015
Need to Update my LG Optimus L9 P769 to at least Kitkat 4.4

I've read that if your LG Optimus L9 P769 was made after June(?) 2013 then you will not be able to unlock your bootloader, however mine was made in 2012. My question is will this method work for me? As stated in the title I need to update my OS past Jellybean 4.1.2.

Another question I have is will I be able to do this process on Windows 7? I watched the video and saw that he chose to change the compatibility of a program to Windows XP (I think..).

Also, does anyone know how to backup nearly everything on my phone so when I do install a custom ROM for Kitkat 4.4 I can just recover everything (contacts, messages, pictures, videos, etc....everything basically :p)?

And lastly, is there a trusted and stable ROM for Kitkat 4.4?

---------- Post added at 08:17 AM ---------- Previous post was at 08:13 AM ----------

When this in the review process , to the point that checks the battery my stop .Diz that the battery is low , and this fully charged. Do you know why that?
I've read that for some reason the phone thinks its at 1% battery instead of 100%. Try draining the battery to 80-90% and try again.


New member
Mar 29, 2015
Stuck at the end

SO i got all the way through the tutorial then when i get to the end where i was entering the "abd-reboot oem-unlock" command it wouldn't come up with a screen asking if i wanted to unlock the bootloader. PLease help!


Apr 12, 2012
Can you re-upload dropbox link with zipped "Adb" "Recovery image" "V6.bin" and "V20_00.bin"? Provided link is dead. Thanks :good:


New member
Dec 2, 2016
Thank you very much, it's working very well on my LG P769 on witch I installed an european firmware not knowing that is not compatible with the phones bought from United States so my touchscreen did not work anymore untill I foun your thread an tryed your solution.

Top Liked Posts

  • There are no posts matching your filters.
  • 62
    Ok So Here Is The Link Might Say Still Uploading Depending The Time Your Reading I Will Post The Files I Use Tomorrow And Remember A Thumbs Up Both Here And On The Video Would Be Appreciated (; Good Luck :)


    V20B Root Bin
    Files That Go On SD Card
    Root Guides
    USB Driver And Text File Describing Locations
    V20B KDZ
    Wasn't Able To Upload Can Anyone Help Me out with this one? still struggling with internet problems...

    All The Files In One Zip
    Thank You ggfool


    Warning Just to let you know that this will Void your warranty you should already know that 

    Also this may look really long but its short just somewhat really specific 

    Hello Fellow Optimus L9 Users today I Bring you a tutorial on how to unlock bootloader the noob version for those who are new to rooting and stuff because there is another one that is more complicated and less specific but if you want to check it out heres
    the link http://forum.xda-developers.com/showthread.php?t=2198114

    Okay First to let you know that when you flash V20B_00.kdz the screen will get kind
    of funky everything will be inverted and backwards so dont worry. And one more thing is
    that when you boot up every single time after doing this the boot will be mirrored. Just
    to let you know.

    First Just want to thank "pinoyto" "Lelus" and "cmahendra"
    Okay Now to Start Download the zip containing the files link here https://www.dropbox.com/s/uxwvkkp8yyyev0k/Bootloader Unlock .zip Files contained
    in the zip are "Adb" "Recovery image" "V6.bin" and "V20_00.bin"
    After youve downloaded extract the files to a folder for later use.

    Now before we go to flash the V20.kdz enable "usb debugging"

    Now go flash the kdz with this tutorial http://forum.xda-developers.com/showthread.php?p=36351786

    1)Now after you've flashed then comes the screen problem just unlock and go throught the setup quickly

    2) Connect your usb and make sure the usb debbuging icon pop-ups the little spider looking thing if thats enabled good

    3) Okay next im not really sure if its needed but just do it change the usb
    entrance to "LG Software Mode" to do this the simple way you need to disconnect usb and
    connect again after than the options appear what type of usb entrance click on the back arrow
    and it should select the "LG Software Mode"

    4) Now we want to connect to the WiFi THIS IS NECESSARY FOR IT TO WORK go and connect to it
    after that make sure you are connected by opening the browser or youtube and if a page or
    video loads your set now go make yourself a coffee or some thing because now you have to wait
    30 or more minutes

    5) Ok now that the 30 minutes or more have passed you need to go to the downloaded files and move
    the "Android" folder to your "C:\" drive "dont worry just has adb files" now open a command prompt and
    type the following
    "cd c:\Android"
    "adb devices" to make sure your phone is connected a list of numbers should appear
    "adb reboot oem-unlock" and your phone should then reboot
    then the lg logo will appear then a mirrored confirmation to unlock bootloader just press
    the "Volume Up" button and it will confirm it then hold the power button until it reboots

    6) Now we need to go to "rooted 10g" again just go here http://forum.xda-developers.com/showthread.php?t=2173465
    and follow every single instruction but when you are about to enter the flashing process instead
    of "Emergency" mode you need to put it to "Diag" mode and then start the flashing process

    7) After you are done with that you cant boot so you must perform a wipe and the way of doing that
    is too have phone off hold "Power button + Volume Down + Home Button" then you should see
    a android with the little globe and a loading bar after its done it will turn off then
    now reboot and after it boot it will be mirrored you can fix that but in my opinion it is a little more confusing
    because the screen is still messed up the whole left side is inverted with the right side but if you still want to remove the mirror
    you must press the power button once to turn off screen then again to turn on and it will be fixed but the touch is still inverted

    8) Now go through setup and enable usb debugging and then u need to go to the superuser app
    and if you dont have it you did not do the root process correctly go to it again "and if you need help just pm me"
    open the app and update the binary after that go to your computer and open command promt again
    and enter the following commands but before you must put the v6.bin file to your external sd card it is in the downloaded files after you have put it to the root
    of your external sd card enter the following commands
    "cd c:\Android"
    "adb shell"
    "su" when you enter this go to your phone and accept the su request
    "cat /sdcard/external_sd/v6.bin > /sys/devices/virtual/input/lge_touch/firmware"
    after you entered the last command you need to close that command promt and open
    another one and type the following commands
    "cd c:\Android"
    "adb shell"
    "reboot" then it will reboot and the touch will corectly work remember the mirrored problem will continue
    to occur on your phone like i said just turn off screen then turn it on and it will be fixed
    Now you have unlocked bootloader 
    If you want to install the cm10 rom the optimus L9 has as of right now you
    have to do the following

    1) Go to the app store and search for the app called "Nandroid Manager ROOT"
    download the app and open it then go to flash recovery you must first put the recovery from the downloaded file to the
    root of you external sd card and then go to the app and search for the recovery and flash it.
    After you flash it you will have a recovery on your phone
    (just to let you know it will be mirrored) but to boot to recovery you must turn off the phone
    and then hold the "Volume UP + Home Button + Power Button"
    now go download the cm10 rom from here " http://forum.xda-developers.com/showthread.php?t=2216542 " put the file to the root of your sd card and then reboot to recovery and then to flash you will need to "wipe system, wipe cache, and wipe dalvik cache then flash" after you flash the zip reboot and you will have CM10 Hope This helped :D

    -Credits to geeshiet for still having a copy of my guide Thank You geeshiet
    hello folks, seem not quite easy, i got big headache to load the bootloader into ida, looks like omap processors use different addesses, while the good old msm7x30 was reading the bootloader at location 0 the omap don't. To get the bootloader show in ida i have had to load it twice at two memory locations, first one is at 0x9d000000 and the second at 0x9e000000. dunno really if this approach is correct but using this trick i can see all the text stings correctly extracted by ida.
    Bootloader code on E730 was much more straightforward, this one use some tricks that make (at least for me) impossible to guess what is the next instruction to execute.
    If i guessed the labels correctly, the most interesting part of the bootloader is this one

    RAM:9D0133FC boot_main ; CODE XREF: RAM:9D01393Cp
    RAM:9D0133FC var_978 = -0x978
    RAM:9D0133FC var_180 = -0x180
    RAM:9D0133FC var_174 = -0x174
    RAM:9D0133FC var_EC = -0xEC
    RAM:9D0133FC STMFD SP!, {R4-R6,LR}
    RAM:9D013400 MOV R3, 0x9CFFFFFF
    RAM:9D013404 SUB SP, SP, #0x970
    RAM:9D013408 MOV R5, R0
    RAM:9D01340C LDR R4, [R3,#-0x357]
    RAM:9D013410 BL sub_9D014958
    RAM:9D013414 CMP R0, #1
    RAM:9D013418 BNE MmcInitFail_bootimg
    RAM:9D01341C MOV R0, asc_9D03096C ; "======================================="...
    RAM:9D013424 BL Print_on_screen
    RAM:9D013428 MOV R0, asc_9D03096C ; "======================================="...
    RAM:9D013430 BL Print_on_screen
    RAM:9D013434 MOV R0, aFotaProcessLk ; " FOTA process LK\n"
    RAM:9D01343C BL Print_on_screen
    RAM:9D013440 MOV R0, asc_9D03096C ; "======================================="...
    RAM:9D013448 BL Print_on_screen
    RAM:9D01344C MOV R0, asc_9D03096C ; "======================================="...
    RAM:9D013454 BL Print_on_screen
    RAM:9D013458 MOV R1, #0x9C8
    RAM:9D01345C MOV R0, R4
    RAM:9D013460 MOVT R1, #0x9D03
    RAM:9D013464 BL sub_9D0175D4
    RAM:9D013468 SUBS R3, R0, #0
    RAM:9D01346C BEQ NoFotaPart
    RAM:9D013470 MOV R1, #0x9F4
    RAM:9D013474 MOV R0, R4
    RAM:9D013478 MOVT R1, #0x9D03
    RAM:9D01347C LDR R6, [R3,#0x10]
    RAM:9D013480 BL sub_9D0175D4
    RAM:9D013484 CMP R0, #0
    RAM:9D013488 BEQ NoFotaUboot
    RAM:9D01348C LDR LR, [R0,#0x14]
    RAM:9D013490 MOV R12, unk_9D126788
    RAM:9D013498 ADD R3, SP, #0x980+var_180
    RAM:9D01349C ADD R0, R3, #8
    RAM:9D0134A0 ADD R6, R6, LR,LSR#9
    RAM:9D0134A4 STR R6, [R12]
    RAM:9D0134A8 BL mmcReadErrLoadFOTAUSD
    RAM:9D0134AC LDR R2, [SP,#0x980+var_174]
    RAM:9D0134B0 MOV R1, 0xF0F85EFE
    RAM:9D0134B8 ADD R0, R2, R1
    RAM:9D0134BC CMP R0, #2
    RAM:9D0134C0 BHI boot_linux_emmc
    RAM:9D0134C4 LDR R0, [SP,#0x980+var_EC]
    RAM:9D0134C8 CMP R0, #0x1A
    RAM:9D0134CC BEQ boot_linux_emmc
    RAM:9D0134D0 MOV R0, asc_9D03096C ; "======================================="...
    RAM:9D0134D8 BL Print_on_screen
    RAM:9D0134DC MOV R0, aGotoRecoveryForF ; " Goto recovery for FOTA up"...
    RAM:9D0134E4 BL Print_on_screen
    RAM:9D0134E8 MOV R0, asc_9D03096C ; "======================================="...
    RAM:9D0134F0 BL Print_on_screen
    RAM:9D0134F4 MOV R0, unk_9D02E694
    RAM:9D0134FC BL Print_on_screen
    RAM:9D013500 MOV R1, #0xA50
    RAM:9D013504 MOV R0, R4
    RAM:9D013508 MOVT R1, #0x9D03
    RAM:9D01350C BL sub_9D0175D4
    RAM:9D013510 CMP R0, #0
    RAM:9D013514 BEQ NoKernPart
    RAM:9D013518 LDR R6, [R0,#0x10]
    RAM:9D01351C MOV R0, aToRecoveryLu ; " to recovery [%lu]!\n"
    RAM:9D013524 MOV R1, R6
    RAM:9D013528 BL Print_on_screen
    RAM:9D01352C Secure_Boot ; CODE XREF: boot_main+3F0j
    RAM:9D01352C MOV R4, #0x678C
    RAM:9D013530 MOV R0, R5
    RAM:9D013534 MOVT R4, #0x9D12
    RAM:9D013538 MOV R1, R6
    RAM:9D01353C MOV R2, R4
    RAM:9D013540 MOV R3, #0x200
    RAM:9D013544 BL read_block_from_mmc
    RAM:9D013548 CMP R0, #1
    RAM:9D01354C BNE FailToLoadBootHdr
    RAM:9D013550 MOV R1, #0xB10
    RAM:9D013554 MOV R0, R4
    RAM:9D013558 MOVT R1, #0x9D03
    RAM:9D01355C MOV R2, #8
    RAM:9D013560 BL chk_magic
    RAM:9D013564 CMP R0, #0
    RAM:9D013568 BNE Bad_magic
    RAM:9D01356C LDR R12, [R4,#0x24]
    RAM:9D013570 MOV R0, R5
    RAM:9D013574 LDR R2, [R4,#0xC]
    RAM:9D013578 LDR R3, [R4,#8]
    RAM:9D01357C ADD R6, R6, R12,LSR#9
    RAM:9D013580 MOV R1, R6
    RAM:9D013584 BL read_block_from_mmc
    RAM:9D013588 CMP R0, #1
    RAM:9D01358C BNE FailToLoadKernel
    RAM:9D013590 LDR R1, [R4,#0x24]
    RAM:9D013594 MOV R0, R5
    RAM:9D013598 LDR LR, [R4,#8]
    RAM:9D01359C LDR R2, [R4,#0x14]
    RAM:9D0135A0 RSB R12, R1, #0
    RAM:9D0135A4 LDR R3, [R4,#0x10]
    RAM:9D0135A8 ADD R1, R1, LR
    RAM:9D0135AC SUB R1, R1, #1
    RAM:9D0135B0 AND LR, R1, R12
    RAM:9D0135B4 ADD R6, R6, LR,LSR#9
    RAM:9D0135B8 MOV R1, R6
    RAM:9D0135BC BL read_block_from_mmc
    RAM:9D0135C0 CMP R0, #1
    RAM:9D0135C4 BNE FailToLoadRamDSK
    RAM:9D0135C8 BL sub_9D0076C0
    RAM:9D0135CC MOV R1, R0
    RAM:9D0135D0 MOV R0, BeforeSecureBoot ; "before secure booting - current time: %"...
    RAM:9D0135D8 BL Print_on_screen
    RAM:9D0135DC BL sub_9D017D8C
    RAM:9D0135E0 MOV R0, SecureBootStart ; "Secure boot started\n"
    RAM:9D0135E8 BL sub_9D015E84
    RAM:9D0135EC MOV R0, asc_9D02FC70 ; "---------------------------------------"...
    RAM:9D0135F4 BL Print_on_screen
    RAM:9D0135F8 MOV R0, InfoLge_security ; "INFO: LGE_SECURITY boot is started~!!!\n"...
    RAM:9D013600 BL Print_on_screen
    RAM:9D013604 LDR R1, [R4,#0x24]
    RAM:9D013608 MOV R0, R5
    RAM:9D01360C LDR LR, [R4,#0x10]
    RAM:9D013610 ADD R2, SP, #0x980+var_978
    RAM:9D013614 MOV R3, #0x800
    RAM:9D013618 RSB R12, R1, #0
    RAM:9D01361C ADD R1, R1, LR
    RAM:9D013620 SUB LR, R1, #1
    RAM:9D013624 AND R1, LR, R12
    RAM:9D013628 ADD R1, R6, R1,LSR#9
    RAM:9D01362C BL read_block_from_mmc
    RAM:9D013630 CMP R0, #1
    RAM:9D013634 BEQ bootImgSignature
    RAM:9D013638 MOV R0, #0xC14
    RAM:9D01363C MOV R5, #0x4E1F
    RAM:9D013640 MOVT R0, #0x9D03
    RAM:9D013644 BL Print_on_screen
    RAM:9D013648 MOV R0, CannotReadCertImg ; "CANNOT READ CERTIFICATION IMAGE\n "
    RAM:9D013650 BL Print_on_screen
    RAM:9D013654 MOV R0, #2
    RAM:9D013658 BL sub_9D00F4E0
    RAM:9D01365C MOV R12, #0xE29C
    RAM:9D013660 MOV R0, #0xA600
    RAM:9D013664 MOVT R12, #0x9D12
    RAM:9D013668 MOVT R0, #0x9D0C
    RAM:9D01366C LDRH R2, [R12]
    RAM:9D013670 MOV R1, #0x87000000
    RAM:9D013674 LDRH R3, [R12,#2]
    RAM:9D013678 MUL R2, R2, R3
    RAM:9D01367C BL sub_9D001994
    RAM:9D013680 MOV R0, #2
    RAM:9D013684 BL sub_9D00F53C
    RAM:9D013688 loc_9D013688 ; CODE XREF: boot_main+2A8j
    RAM:9D013688 SUB R5, R5, #1
    RAM:9D01368C MOV R0, #0x3E8
    RAM:9D013690 BL sub_9D00760C
    RAM:9D013694 SUB R5, R5, #1
    RAM:9D013698 MOV R0, #0x3E8
    RAM:9D01369C BL sub_9D00760C
    RAM:9D0136A0 CMN R5, #1
    RAM:9D0136A4 BNE loc_9D013688
    RAM:9D0136A8 MOV R0, #7
    RAM:9D0136AC BL sub_9D0058BC
    RAM:9D0136B0 bootImgSignature ; CODE XREF: boot_main+238j
    RAM:9D0136B0 LDR R0, [R4,#0xC]
    RAM:9D0136B4 ADD R12, SP, #0x980+var_978
    RAM:9D0136B8 LDR R1, [R4,#8]
    RAM:9D0136BC MOV LR, #0x400
    RAM:9D0136C0 LDR R2, [R4,#0x14]
    RAM:9D0136C4 LDR R3, [R4,#0x10]
    RAM:9D0136C8 STMEA SP, {R12,LR}
    RAM:9D0136CC BL sub_9D017DBC
    RAM:9D0136D0 CMP R0, #0
    RAM:9D0136D4 BNE NoBootImgSign

    RAM:9D0136D8 secure_boot_end ; CODE XREF: boot_main+494j
    RAM:9D0136D8 BL sub_9D0076C0
    RAM:9D0136DC MOV R1, R0
    RAM:9D0136E0 MOV R0, AfterSecureBoot ; "after secure booting - current time: %l"...
    RAM:9D0136E8 BL Print_on_screen
    RAM:9D0136EC MOV R0, SecureBootEnd ; "Secure boot End\n"
    RAM:9D0136F4 BL sub_9D015E84
    RAM:9D0136F8 MOV R0, #0xCDC
    RAM:9D0136FC LDR R1, [R4,#0xC]
    RAM:9D013700 LDR R2, [R4,#8]
    RAM:9D013704 MOVT R0, #0x9D03
    RAM:9D013708 BL Print_on_screen
    RAM:9D01370C MOV R0, #0xCF4
    RAM:9D013710 LDR R2, [R4,#0x10]
    RAM:9D013714 LDR R1, [R4,#0x14]
    RAM:9D013718 MOVT R0, #0x9D03
    RAM:9D01371C BL Print_on_screen
    RAM:9D013720 LDR R1, [R4,#8]
    RAM:9D013724 LDR R0, [R4,#0xC]
    RAM:9D013728 BL sub_9D013D14
    RAM:9D01372C MOV R0, aKernelIsNotChang ; "Kernel is not changed. Starting kernel."...
    RAM:9D013734 BL Print_on_screen
    RAM:9D013738 MOV R0, unk_9D12678C
    RAM:9D013740 BL starting_kernel
    RAM:9D013744 MOV R0, aBootKernelFailed ; "boot kernel failed!\n"
    RAM:9D01374C BL Print_on_screen
    RAM:9D013750 MOV R0, #0

    so, apparently, the code in bold, make the code jump if the img signature is missing or tampered. Nopping the BNE make it to skip the check at all, seem so easy but.....
    altering a bootloader is a risky thing. if there is somewhere an integrity check or if the patch is wrong, it could lead on an hard bricked device. i have hard bricked mine once and i was lucky to revive it, i know how to reflash a dead E730, but i know nothing about an L9.
    i will include on this post the ida .idb file, so maybe someone else skilled on arm asm can read it and suggest another/better way.
    I can patch the bootloader easily but i want you know what the tester (i can't test because i don't have the device) is risking.
    Ok. I just sent him the database and @shinobisoft x-loader. ;)

    Sent from my LG-P769 using XDA Premium 4 mobile app

    i just managed to load into ida the x-loader at the correct address and filled some labels.

    there are some interesting part of code regarding signature check. dunno if he can post here, but i'd like to share with him some thoughts.

    here is the x-boot dissamble, Base Address: 40304350h - 40360A00h just a insane mind at Ti could choose an address like that.
    Gonna upload a updated video hopefully that fixes everyone's problems...

    Sent from my LG-P769
    Shutt1e needs more time. He debugged some of it and realized that it will take a bit more time. Just wanted to keep you guys updated.

    Sent from my LG-P769 using XDA Premium 4 mobile app