[Guide]Unlock Bootloader for Noobs P769

Search This thread

carloswii5

Senior Member
Jul 9, 2012
437
243
Pallet Town
Ok So Here Is The Link Might Say Still Uploading Depending The Time Your Reading I Will Post The Files I Use Tomorrow And Remember A Thumbs Up Both Here And On The Video Would Be Appreciated (; Good Luck :)

http://www.youtube.com/watch?v=WyNtFP_TkKc&feature=youtu.be


V20B Root Bin
https://drive.google.com/uc?id=0B059sYrh0T19S1hfN25fdnVUVWs&export=download
Files That Go On SD Card
https://docs.google.com/viewer?a=v&pid=explorer&srcid=0B059sYrh0T19RWFYcERIQVVoSkU
Root Guides
https://docs.google.com/viewer?a=v&pid=explorer&srcid=0B059sYrh0T19R1NPUkZEc240U0k
USB Driver And Text File Describing Locations
https://docs.google.com/viewer?a=v&pid=explorer&srcid=0B059sYrh0T19V1JSS0hNUWpDRnc
V20B KDZ
Wasn't Able To Upload Can Anyone Help Me out with this one? still struggling with internet problems...

All The Files In One Zip
Thank You ggfool
https://mega.co.nz/#!ElNxlS4C!Ko_1FSI68loOrkrQdYNutDqkQ2QHRX9vPe7MyXrkqNM

*OLD TUTORIAL*


Warning Just to let you know that this will Void your warranty you should already know that 

Also this may look really long but its short just somewhat really specific 

Hello Fellow Optimus L9 Users today I Bring you a tutorial on how to unlock bootloader the noob version for those who are new to rooting and stuff because there is another one that is more complicated and less specific but if you want to check it out heres
the link http://xdaforums.com/showthread.php?t=2198114

Okay First to let you know that when you flash V20B_00.kdz the screen will get kind
of funky everything will be inverted and backwards so dont worry. And one more thing is
that when you boot up every single time after doing this the boot will be mirrored. Just
to let you know.


First Just want to thank "pinoyto" "Lelus" and "cmahendra"
Okay Now to Start Download the zip containing the files link here https://www.dropbox.com/s/uxwvkkp8yyyev0k/Bootloader Unlock .zip Files contained
in the zip are "Adb" "Recovery image" "V6.bin" and "V20_00.bin"
After youve downloaded extract the files to a folder for later use.

Now before we go to flash the V20.kdz enable "usb debugging"

Now go flash the kdz with this tutorial http://xdaforums.com/showthread.php?p=36351786

1)Now after you've flashed then comes the screen problem just unlock and go throught the setup quickly

2) Connect your usb and make sure the usb debbuging icon pop-ups the little spider looking thing if thats enabled good

3) Okay next im not really sure if its needed but just do it change the usb
entrance to "LG Software Mode" to do this the simple way you need to disconnect usb and
connect again after than the options appear what type of usb entrance click on the back arrow
and it should select the "LG Software Mode"

4) Now we want to connect to the WiFi THIS IS NECESSARY FOR IT TO WORK go and connect to it
after that make sure you are connected by opening the browser or youtube and if a page or
video loads your set now go make yourself a coffee or some thing because now you have to wait
30 or more minutes

5) Ok now that the 30 minutes or more have passed you need to go to the downloaded files and move
the "Android" folder to your "C:\" drive "dont worry just has adb files" now open a command prompt and
type the following
"cd c:\Android"
"adb devices" to make sure your phone is connected a list of numbers should appear
"adb reboot oem-unlock" and your phone should then reboot
then the lg logo will appear then a mirrored confirmation to unlock bootloader just press
the "Volume Up" button and it will confirm it then hold the power button until it reboots

6) Now we need to go to "rooted 10g" again just go here http://xdaforums.com/showthread.php?t=2173465
and follow every single instruction but when you are about to enter the flashing process instead
of "Emergency" mode you need to put it to "Diag" mode and then start the flashing process

7) After you are done with that you cant boot so you must perform a wipe and the way of doing that
is too have phone off hold "Power button + Volume Down + Home Button" then you should see
a android with the little globe and a loading bar after its done it will turn off then
now reboot and after it boot it will be mirrored you can fix that but in my opinion it is a little more confusing
because the screen is still messed up the whole left side is inverted with the right side but if you still want to remove the mirror
you must press the power button once to turn off screen then again to turn on and it will be fixed but the touch is still inverted

8) Now go through setup and enable usb debugging and then u need to go to the superuser app
and if you dont have it you did not do the root process correctly go to it again "and if you need help just pm me"
open the app and update the binary after that go to your computer and open command promt again
and enter the following commands but before you must put the v6.bin file to your external sd card it is in the downloaded files after you have put it to the root
of your external sd card enter the following commands
"cd c:\Android"
"adb shell"
"su" when you enter this go to your phone and accept the su request
"cat /sdcard/external_sd/v6.bin > /sys/devices/virtual/input/lge_touch/firmware"
after you entered the last command you need to close that command promt and open
another one and type the following commands
"cd c:\Android"
"adb shell"
"su"
"reboot" then it will reboot and the touch will corectly work remember the mirrored problem will continue
to occur on your phone like i said just turn off screen then turn it on and it will be fixed
Now you have unlocked bootloader 
If you want to install the cm10 rom the optimus L9 has as of right now you
have to do the following

1) Go to the app store and search for the app called "Nandroid Manager ROOT"
download the app and open it then go to flash recovery you must first put the recovery from the downloaded file to the
root of you external sd card and then go to the app and search for the recovery and flash it.
After you flash it you will have a recovery on your phone
(just to let you know it will be mirrored) but to boot to recovery you must turn off the phone
and then hold the "Volume UP + Home Button + Power Button"
now go download the cm10 rom from here " http://xdaforums.com/showthread.php?t=2216542 " put the file to the root of your sd card and then reboot to recovery and then to flash you will need to "wipe system, wipe cache, and wipe dalvik cache then flash" after you flash the zip reboot and you will have CM10 Hope This helped :D

-Credits to geeshiet for still having a copy of my guide Thank You geeshiet
 
Last edited:

carloswii5

Senior Member
Jul 9, 2012
437
243
Pallet Town
So you or another user have tried it? Because it claims to work with the P769. Now, I know these things aren't always accurate, but I'm trying to ascertain exactly how you know that it only works for the P760.



Sent from my Inspire 4G w/CM10.1

Because the only L9 variant that came with the option to unlock the boot loader in the jellybean update was the P760

A Person Who Never Made A Mistake Never Tried Anything New. -Albert Einstein
 
  • Like
Reactions: hieuqu

WordsworthESP

Senior Member
Jul 23, 2012
804
471
Macon
Because the only L9 variant that came with the option to unlock the boot loader in the jellybean update was the P760

A Person Who Never Made A Mistake Never Tried Anything New. -Albert Einstein
Ok, thanks. While I'm quite experienced with rooting and flashing for the HTC Inspire, I'm (clearly) very new to this phone, and LG's in general. So many thanks for the "noob tutorial."


Sent from my Inspire 4G w/CM10.1
 

carloswii5

Senior Member
Jul 9, 2012
437
243
Pallet Town
Ok, thanks. While I'm quite experienced with rooting and flashing for the HTC Inspire, I'm (clearly) very new to this phone, and LG's in general. So many thanks for the "noob tutorial."


Sent from my Inspire 4G w/CM10.1

Yea I figured I would make one because some people were struggling with the other tut here on the forums

Anyone who has never made a mistake has never tried anything new. -Albert Einstein
 
  • Like
Reactions: hieuqu

bratten2121

Senior Member
Jan 16, 2008
91
3
Hey i figured it out, so I flashed v20b over v20d and I waitied about 45 mins with wifi on and still cant get this to unlock. I have also rooted my phone before this and tried flashing v20b again and still nothing happen. Is it too late for me to get this unlocked?
 

carloswii5

Senior Member
Jul 9, 2012
437
243
Pallet Town
Hey i figured it out, so I flashed v20b over v20d and I waitied about 45 mins with wifi on and still cant get this to unlock. I have also rooted my phone before this and tried flashing v20b again and still nothing happen. Is it too late for me to get this unlocked?

No its never too late :p but there must be something you forgot to do or did incorrectly did you run "adb reboot oem-unlock" before connecting to wifi and waiting at least 30 min?

Sent From My Cyanogen Running P769
 

nevkuril

Member
Feb 18, 2013
36
17
Just unlocked bootloader on my phone. Looks like having SIM card with data is a must. Tried all day yesterday on WiFi, never worked. Finally bought a SIM unlock code on eBay and used my StraightTalk SIM card. Reverted back v10G, set everything up (had to type APNs manually), turned WiFi off and verified that data works. Flashed v20B again, verified that WiFi is still off and data is on, waited for about half hour. Unlocked on the first try.
So whoever is having troubles, looks like you just need working SIM with data and WiFi it not really necessary.
 
Last edited:

carloswii5

Senior Member
Jul 9, 2012
437
243
Pallet Town
Just unlocked bootloader on my phone. Looks like having SIM card with data is a must. Tried all day yesterday on WiFi, never worked. Finally bought a SIM unlock code on eBay and used my StraightTalk SIM card. Reverted back v10G, set everything up (had to type APNs manually), turned WiFi off and verified that data works. Flashed v20B again, verified that WiFi is still off and data is on, waited for about half hour. Unlocked on the first try.
So whoever is having troubles, looks like you just need working SIM with data and WiFi it not really necessary.

Alright thanks for letting me know I'll change it thank you :D

Sent From My Cyanogen Running P769
 

Kid_Ding

Senior Member
Oct 27, 2006
488
198
Clackamas, OR
Just unlocked bootloader on my phone. Looks like having SIM card with data is a must. Tried all day yesterday on WiFi, never worked. Finally bought a SIM unlock code on eBay and used my StraightTalk SIM card. Reverted back v10G, set everything up (had to type APNs manually), turned WiFi off and verified that data works. Flashed v20B again, verified that WiFi is still off and data is on, waited for about half hour. Unlocked on the first try.
So whoever is having troubles, looks like you just need working SIM with data and WiFi it not really necessary.

I have straight talk tmobile sim with no apn setup and WiFi on for it to work for me.

I kept waiting 30 mins x3 because I had taken my sim and SD card out due to fear of damage. So I second that keep the sim in and WiFi on (made a guest ssid for one click connect).
@nevkuril do you have st att or tmo? If tmo, I know its late but the tmo sim works without the need for carrier unlock.

Sent from my LG-P769 using xda app-developers app
 

Top Liked Posts

  • There are no posts matching your filters.
  • 62
    Ok So Here Is The Link Might Say Still Uploading Depending The Time Your Reading I Will Post The Files I Use Tomorrow And Remember A Thumbs Up Both Here And On The Video Would Be Appreciated (; Good Luck :)

    http://www.youtube.com/watch?v=WyNtFP_TkKc&feature=youtu.be


    V20B Root Bin
    https://drive.google.com/uc?id=0B059sYrh0T19S1hfN25fdnVUVWs&export=download
    Files That Go On SD Card
    https://docs.google.com/viewer?a=v&pid=explorer&srcid=0B059sYrh0T19RWFYcERIQVVoSkU
    Root Guides
    https://docs.google.com/viewer?a=v&pid=explorer&srcid=0B059sYrh0T19R1NPUkZEc240U0k
    USB Driver And Text File Describing Locations
    https://docs.google.com/viewer?a=v&pid=explorer&srcid=0B059sYrh0T19V1JSS0hNUWpDRnc
    V20B KDZ
    Wasn't Able To Upload Can Anyone Help Me out with this one? still struggling with internet problems...

    All The Files In One Zip
    Thank You ggfool
    https://mega.co.nz/#!ElNxlS4C!Ko_1FSI68loOrkrQdYNutDqkQ2QHRX9vPe7MyXrkqNM

    *OLD TUTORIAL*


    Warning Just to let you know that this will Void your warranty you should already know that 

    Also this may look really long but its short just somewhat really specific 

    Hello Fellow Optimus L9 Users today I Bring you a tutorial on how to unlock bootloader the noob version for those who are new to rooting and stuff because there is another one that is more complicated and less specific but if you want to check it out heres
    the link http://xdaforums.com/showthread.php?t=2198114

    Okay First to let you know that when you flash V20B_00.kdz the screen will get kind
    of funky everything will be inverted and backwards so dont worry. And one more thing is
    that when you boot up every single time after doing this the boot will be mirrored. Just
    to let you know.


    First Just want to thank "pinoyto" "Lelus" and "cmahendra"
    Okay Now to Start Download the zip containing the files link here https://www.dropbox.com/s/uxwvkkp8yyyev0k/Bootloader Unlock .zip Files contained
    in the zip are "Adb" "Recovery image" "V6.bin" and "V20_00.bin"
    After youve downloaded extract the files to a folder for later use.

    Now before we go to flash the V20.kdz enable "usb debugging"

    Now go flash the kdz with this tutorial http://xdaforums.com/showthread.php?p=36351786

    1)Now after you've flashed then comes the screen problem just unlock and go throught the setup quickly

    2) Connect your usb and make sure the usb debbuging icon pop-ups the little spider looking thing if thats enabled good

    3) Okay next im not really sure if its needed but just do it change the usb
    entrance to "LG Software Mode" to do this the simple way you need to disconnect usb and
    connect again after than the options appear what type of usb entrance click on the back arrow
    and it should select the "LG Software Mode"

    4) Now we want to connect to the WiFi THIS IS NECESSARY FOR IT TO WORK go and connect to it
    after that make sure you are connected by opening the browser or youtube and if a page or
    video loads your set now go make yourself a coffee or some thing because now you have to wait
    30 or more minutes

    5) Ok now that the 30 minutes or more have passed you need to go to the downloaded files and move
    the "Android" folder to your "C:\" drive "dont worry just has adb files" now open a command prompt and
    type the following
    "cd c:\Android"
    "adb devices" to make sure your phone is connected a list of numbers should appear
    "adb reboot oem-unlock" and your phone should then reboot
    then the lg logo will appear then a mirrored confirmation to unlock bootloader just press
    the "Volume Up" button and it will confirm it then hold the power button until it reboots

    6) Now we need to go to "rooted 10g" again just go here http://xdaforums.com/showthread.php?t=2173465
    and follow every single instruction but when you are about to enter the flashing process instead
    of "Emergency" mode you need to put it to "Diag" mode and then start the flashing process

    7) After you are done with that you cant boot so you must perform a wipe and the way of doing that
    is too have phone off hold "Power button + Volume Down + Home Button" then you should see
    a android with the little globe and a loading bar after its done it will turn off then
    now reboot and after it boot it will be mirrored you can fix that but in my opinion it is a little more confusing
    because the screen is still messed up the whole left side is inverted with the right side but if you still want to remove the mirror
    you must press the power button once to turn off screen then again to turn on and it will be fixed but the touch is still inverted

    8) Now go through setup and enable usb debugging and then u need to go to the superuser app
    and if you dont have it you did not do the root process correctly go to it again "and if you need help just pm me"
    open the app and update the binary after that go to your computer and open command promt again
    and enter the following commands but before you must put the v6.bin file to your external sd card it is in the downloaded files after you have put it to the root
    of your external sd card enter the following commands
    "cd c:\Android"
    "adb shell"
    "su" when you enter this go to your phone and accept the su request
    "cat /sdcard/external_sd/v6.bin > /sys/devices/virtual/input/lge_touch/firmware"
    after you entered the last command you need to close that command promt and open
    another one and type the following commands
    "cd c:\Android"
    "adb shell"
    "su"
    "reboot" then it will reboot and the touch will corectly work remember the mirrored problem will continue
    to occur on your phone like i said just turn off screen then turn it on and it will be fixed
    Now you have unlocked bootloader 
    If you want to install the cm10 rom the optimus L9 has as of right now you
    have to do the following

    1) Go to the app store and search for the app called "Nandroid Manager ROOT"
    download the app and open it then go to flash recovery you must first put the recovery from the downloaded file to the
    root of you external sd card and then go to the app and search for the recovery and flash it.
    After you flash it you will have a recovery on your phone
    (just to let you know it will be mirrored) but to boot to recovery you must turn off the phone
    and then hold the "Volume UP + Home Button + Power Button"
    now go download the cm10 rom from here " http://xdaforums.com/showthread.php?t=2216542 " put the file to the root of your sd card and then reboot to recovery and then to flash you will need to "wipe system, wipe cache, and wipe dalvik cache then flash" after you flash the zip reboot and you will have CM10 Hope This helped :D

    -Credits to geeshiet for still having a copy of my guide Thank You geeshiet
    12
    hello folks, seem not quite easy, i got big headache to load the bootloader into ida, looks like omap processors use different addesses, while the good old msm7x30 was reading the bootloader at location 0 the omap don't. To get the bootloader show in ida i have had to load it twice at two memory locations, first one is at 0x9d000000 and the second at 0x9e000000. dunno really if this approach is correct but using this trick i can see all the text stings correctly extracted by ida.
    Bootloader code on E730 was much more straightforward, this one use some tricks that make (at least for me) impossible to guess what is the next instruction to execute.
    If i guessed the labels correctly, the most interesting part of the bootloader is this one


    RAM:9D0133FC boot_main ; CODE XREF: RAM:9D01393Cp
    RAM:9D0133FC
    RAM:9D0133FC var_978 = -0x978
    RAM:9D0133FC var_180 = -0x180
    RAM:9D0133FC var_174 = -0x174
    RAM:9D0133FC var_EC = -0xEC
    RAM:9D0133FC
    RAM:9D0133FC STMFD SP!, {R4-R6,LR}
    RAM:9D013400 MOV R3, 0x9CFFFFFF
    RAM:9D013404 SUB SP, SP, #0x970
    RAM:9D013408 MOV R5, R0
    RAM:9D01340C LDR R4, [R3,#-0x357]
    RAM:9D013410 BL sub_9D014958
    RAM:9D013414 CMP R0, #1
    RAM:9D013418 BNE MmcInitFail_bootimg
    RAM:9D01341C MOV R0, asc_9D03096C ; "======================================="...
    RAM:9D013424 BL Print_on_screen
    RAM:9D013428 MOV R0, asc_9D03096C ; "======================================="...
    RAM:9D013430 BL Print_on_screen
    RAM:9D013434 MOV R0, aFotaProcessLk ; " FOTA process LK\n"
    RAM:9D01343C BL Print_on_screen
    RAM:9D013440 MOV R0, asc_9D03096C ; "======================================="...
    RAM:9D013448 BL Print_on_screen
    RAM:9D01344C MOV R0, asc_9D03096C ; "======================================="...
    RAM:9D013454 BL Print_on_screen
    RAM:9D013458 MOV R1, #0x9C8
    RAM:9D01345C MOV R0, R4
    RAM:9D013460 MOVT R1, #0x9D03
    RAM:9D013464 BL sub_9D0175D4
    RAM:9D013468 SUBS R3, R0, #0
    RAM:9D01346C BEQ NoFotaPart
    RAM:9D013470 MOV R1, #0x9F4
    RAM:9D013474 MOV R0, R4
    RAM:9D013478 MOVT R1, #0x9D03
    RAM:9D01347C LDR R6, [R3,#0x10]
    RAM:9D013480 BL sub_9D0175D4
    RAM:9D013484 CMP R0, #0
    RAM:9D013488 BEQ NoFotaUboot
    RAM:9D01348C LDR LR, [R0,#0x14]
    RAM:9D013490 MOV R12, unk_9D126788
    RAM:9D013498 ADD R3, SP, #0x980+var_180
    RAM:9D01349C ADD R0, R3, #8
    RAM:9D0134A0 ADD R6, R6, LR,LSR#9
    RAM:9D0134A4 STR R6, [R12]
    RAM:9D0134A8 BL mmcReadErrLoadFOTAUSD
    RAM:9D0134AC LDR R2, [SP,#0x980+var_174]
    RAM:9D0134B0 MOV R1, 0xF0F85EFE
    RAM:9D0134B8 ADD R0, R2, R1
    RAM:9D0134BC CMP R0, #2
    RAM:9D0134C0 BHI boot_linux_emmc
    RAM:9D0134C4 LDR R0, [SP,#0x980+var_EC]
    RAM:9D0134C8 CMP R0, #0x1A
    RAM:9D0134CC BEQ boot_linux_emmc
    RAM:9D0134D0 MOV R0, asc_9D03096C ; "======================================="...
    RAM:9D0134D8 BL Print_on_screen
    RAM:9D0134DC MOV R0, aGotoRecoveryForF ; " Goto recovery for FOTA up"...
    RAM:9D0134E4 BL Print_on_screen
    RAM:9D0134E8 MOV R0, asc_9D03096C ; "======================================="...
    RAM:9D0134F0 BL Print_on_screen
    RAM:9D0134F4 MOV R0, unk_9D02E694
    RAM:9D0134FC BL Print_on_screen
    RAM:9D013500 MOV R1, #0xA50
    RAM:9D013504 MOV R0, R4
    RAM:9D013508 MOVT R1, #0x9D03
    RAM:9D01350C BL sub_9D0175D4
    RAM:9D013510 CMP R0, #0
    RAM:9D013514 BEQ NoKernPart
    RAM:9D013518 LDR R6, [R0,#0x10]
    RAM:9D01351C MOV R0, aToRecoveryLu ; " to recovery [%lu]!\n"
    RAM:9D013524 MOV R1, R6
    RAM:9D013528 BL Print_on_screen
    RAM:9D01352C
    RAM:9D01352C Secure_Boot ; CODE XREF: boot_main+3F0j
    RAM:9D01352C MOV R4, #0x678C
    RAM:9D013530 MOV R0, R5
    RAM:9D013534 MOVT R4, #0x9D12
    RAM:9D013538 MOV R1, R6
    RAM:9D01353C MOV R2, R4
    RAM:9D013540 MOV R3, #0x200
    RAM:9D013544 BL read_block_from_mmc
    RAM:9D013548 CMP R0, #1
    RAM:9D01354C BNE FailToLoadBootHdr
    RAM:9D013550 MOV R1, #0xB10
    RAM:9D013554 MOV R0, R4
    RAM:9D013558 MOVT R1, #0x9D03
    RAM:9D01355C MOV R2, #8
    RAM:9D013560 BL chk_magic
    RAM:9D013564 CMP R0, #0
    RAM:9D013568 BNE Bad_magic
    RAM:9D01356C LDR R12, [R4,#0x24]
    RAM:9D013570 MOV R0, R5
    RAM:9D013574 LDR R2, [R4,#0xC]
    RAM:9D013578 LDR R3, [R4,#8]
    RAM:9D01357C ADD R6, R6, R12,LSR#9
    RAM:9D013580 MOV R1, R6
    RAM:9D013584 BL read_block_from_mmc
    RAM:9D013588 CMP R0, #1
    RAM:9D01358C BNE FailToLoadKernel
    RAM:9D013590 LDR R1, [R4,#0x24]
    RAM:9D013594 MOV R0, R5
    RAM:9D013598 LDR LR, [R4,#8]
    RAM:9D01359C LDR R2, [R4,#0x14]
    RAM:9D0135A0 RSB R12, R1, #0
    RAM:9D0135A4 LDR R3, [R4,#0x10]
    RAM:9D0135A8 ADD R1, R1, LR
    RAM:9D0135AC SUB R1, R1, #1
    RAM:9D0135B0 AND LR, R1, R12
    RAM:9D0135B4 ADD R6, R6, LR,LSR#9
    RAM:9D0135B8 MOV R1, R6
    RAM:9D0135BC BL read_block_from_mmc
    RAM:9D0135C0 CMP R0, #1
    RAM:9D0135C4 BNE FailToLoadRamDSK
    RAM:9D0135C8 BL sub_9D0076C0
    RAM:9D0135CC MOV R1, R0
    RAM:9D0135D0 MOV R0, BeforeSecureBoot ; "before secure booting - current time: %"...
    RAM:9D0135D8 BL Print_on_screen
    RAM:9D0135DC BL sub_9D017D8C
    RAM:9D0135E0 MOV R0, SecureBootStart ; "Secure boot started\n"
    RAM:9D0135E8 BL sub_9D015E84
    RAM:9D0135EC MOV R0, asc_9D02FC70 ; "---------------------------------------"...
    RAM:9D0135F4 BL Print_on_screen
    RAM:9D0135F8 MOV R0, InfoLge_security ; "INFO: LGE_SECURITY boot is started~!!!\n"...
    RAM:9D013600 BL Print_on_screen
    RAM:9D013604 LDR R1, [R4,#0x24]
    RAM:9D013608 MOV R0, R5
    RAM:9D01360C LDR LR, [R4,#0x10]
    RAM:9D013610 ADD R2, SP, #0x980+var_978
    RAM:9D013614 MOV R3, #0x800
    RAM:9D013618 RSB R12, R1, #0
    RAM:9D01361C ADD R1, R1, LR
    RAM:9D013620 SUB LR, R1, #1
    RAM:9D013624 AND R1, LR, R12
    RAM:9D013628 ADD R1, R6, R1,LSR#9
    RAM:9D01362C BL read_block_from_mmc
    RAM:9D013630 CMP R0, #1
    RAM:9D013634 BEQ bootImgSignature
    RAM:9D013638 MOV R0, #0xC14
    RAM:9D01363C MOV R5, #0x4E1F
    RAM:9D013640 MOVT R0, #0x9D03
    RAM:9D013644 BL Print_on_screen
    RAM:9D013648 MOV R0, CannotReadCertImg ; "CANNOT READ CERTIFICATION IMAGE\n "
    RAM:9D013650 BL Print_on_screen
    RAM:9D013654 MOV R0, #2
    RAM:9D013658 BL sub_9D00F4E0
    RAM:9D01365C MOV R12, #0xE29C
    RAM:9D013660 MOV R0, #0xA600
    RAM:9D013664 MOVT R12, #0x9D12
    RAM:9D013668 MOVT R0, #0x9D0C
    RAM:9D01366C LDRH R2, [R12]
    RAM:9D013670 MOV R1, #0x87000000
    RAM:9D013674 LDRH R3, [R12,#2]
    RAM:9D013678 MUL R2, R2, R3
    RAM:9D01367C BL sub_9D001994
    RAM:9D013680 MOV R0, #2
    RAM:9D013684 BL sub_9D00F53C
    RAM:9D013688
    RAM:9D013688 loc_9D013688 ; CODE XREF: boot_main+2A8j
    RAM:9D013688 SUB R5, R5, #1
    RAM:9D01368C MOV R0, #0x3E8
    RAM:9D013690 BL sub_9D00760C
    RAM:9D013694 SUB R5, R5, #1
    RAM:9D013698 MOV R0, #0x3E8
    RAM:9D01369C BL sub_9D00760C
    RAM:9D0136A0 CMN R5, #1
    RAM:9D0136A4 BNE loc_9D013688
    RAM:9D0136A8 MOV R0, #7
    RAM:9D0136AC BL sub_9D0058BC
    RAM:9D0136B0
    RAM:9D0136B0 bootImgSignature ; CODE XREF: boot_main+238j
    RAM:9D0136B0 LDR R0, [R4,#0xC]
    RAM:9D0136B4 ADD R12, SP, #0x980+var_978
    RAM:9D0136B8 LDR R1, [R4,#8]
    RAM:9D0136BC MOV LR, #0x400
    RAM:9D0136C0 LDR R2, [R4,#0x14]
    RAM:9D0136C4 LDR R3, [R4,#0x10]
    RAM:9D0136C8 STMEA SP, {R12,LR}
    RAM:9D0136CC BL sub_9D017DBC
    RAM:9D0136D0 CMP R0, #0
    RAM:9D0136D4 BNE NoBootImgSign

    RAM:9D0136D8
    RAM:9D0136D8 secure_boot_end ; CODE XREF: boot_main+494j
    RAM:9D0136D8 BL sub_9D0076C0
    RAM:9D0136DC MOV R1, R0
    RAM:9D0136E0 MOV R0, AfterSecureBoot ; "after secure booting - current time: %l"...
    RAM:9D0136E8 BL Print_on_screen
    RAM:9D0136EC MOV R0, SecureBootEnd ; "Secure boot End\n"
    RAM:9D0136F4 BL sub_9D015E84
    RAM:9D0136F8 MOV R0, #0xCDC
    RAM:9D0136FC LDR R1, [R4,#0xC]
    RAM:9D013700 LDR R2, [R4,#8]
    RAM:9D013704 MOVT R0, #0x9D03
    RAM:9D013708 BL Print_on_screen
    RAM:9D01370C MOV R0, #0xCF4
    RAM:9D013710 LDR R2, [R4,#0x10]
    RAM:9D013714 LDR R1, [R4,#0x14]
    RAM:9D013718 MOVT R0, #0x9D03
    RAM:9D01371C BL Print_on_screen
    RAM:9D013720 LDR R1, [R4,#8]
    RAM:9D013724 LDR R0, [R4,#0xC]
    RAM:9D013728 BL sub_9D013D14
    RAM:9D01372C MOV R0, aKernelIsNotChang ; "Kernel is not changed. Starting kernel."...
    RAM:9D013734 BL Print_on_screen
    RAM:9D013738 MOV R0, unk_9D12678C
    RAM:9D013740 BL starting_kernel
    RAM:9D013744 MOV R0, aBootKernelFailed ; "boot kernel failed!\n"
    RAM:9D01374C BL Print_on_screen
    RAM:9D013750 MOV R0, #0

    so, apparently, the code in bold, make the code jump if the img signature is missing or tampered. Nopping the BNE make it to skip the check at all, seem so easy but.....
    altering a bootloader is a risky thing. if there is somewhere an integrity check or if the patch is wrong, it could lead on an hard bricked device. i have hard bricked mine once and i was lucky to revive it, i know how to reflash a dead E730, but i know nothing about an L9.
    i will include on this post the ida .idb file, so maybe someone else skilled on arm asm can read it and suggest another/better way.
    I can patch the bootloader easily but i want you know what the tester (i can't test because i don't have the device) is risking.
    10
    Ok. I just sent him the database and @shinobisoft x-loader. ;)

    Sent from my LG-P769 using XDA Premium 4 mobile app


    i just managed to load into ida the x-loader at the correct address and filled some labels.

    there are some interesting part of code regarding signature check. dunno if he can post here, but i'd like to share with him some thoughts.

    here is the x-boot dissamble, Base Address: 40304350h - 40360A00h just a insane mind at Ti could choose an address like that.
    9
    Gonna upload a updated video hopefully that fixes everyone's problems...

    Sent from my LG-P769
    9
    Shutt1e needs more time. He debugged some of it and realized that it will take a bit more time. Just wanted to keep you guys updated.

    Sent from my LG-P769 using XDA Premium 4 mobile app