[GUIDE] Unlock your LG V40 via 9008 mode (Every Variant except T-Mobile)

Search This thread

athoti

Member
Sep 25, 2018
28
4
So you're on Sprint 20g, which is Android Pie. First (and always) you need to use qfil to backup any partitions you plan on modifying. You say 'someone here provided laf backup' that you used to restore, but that's a prob because Sprint doesn't make their kdz available and I've not seen any backups for the Sprint firmware... so what laf backup did you use?

And, as I explained, there are 2 versions of fastboot; 1) v35 eng abl and 2) laf nuked (watered down) version of fastboot.

I've no experience with the Sprint (watered down) version of (laf nuked) fastboot, but it seems to be like other mfg versions, in that it won't flash a partition. So, you have to use the v35 eng abl fastboot to do that.

Unfortunately, the v35 eng abl won't 'boot' a partition unless it's Oreo. You'll have to use qfil and save your boot partition (a or b), and post it here. I'll inject twrp into it for you and post it back, then use qfil to put it back.

cheers
I got the laf_a and laf_b that ngowner provided here on page 12. I see they are 20e pie but they've worked for me. I went between flashing v35 eng. and deleted laf-a and b and reflashing them a number of times to try to flash twrp but no success. You're right I have fastboot when I delete them but then I can't flash anything because they're deleted ...

Here are the boot partitions. I hope I did it right? I'm not experienced with QFIL. So I went to tools -> partition manager -> boot_a -> read. Is that the way?

Thanks again!
 

Attachments

  • boot partitions LG-V40 pie Sprint.zip
    45.8 MB · Views: 12

Gorbieee

Member
May 12, 2021
9
0
Google Pixel
Do you keep POWER + VOLUME DOWN pressed together, then release them and rapidly press volume up as soon as the screen goes blank? Or even a split second before. You may have to try a number of times. You can do it (pressing the buttons) from Fastboot or Download mode too.

Also I had to restart my computer before it worked. Now it works every time no problem. I tried both USB 2.0 and 3.0 but it didn't make a difference.

If the bootloader is unlocked it should show at startup a yellow triangle with "your device cannot be checked for corruption bla bla bla"
Absolutely love how fast the response time is on here (not sarcasm). I managed to get the phone into 9008 mode, boy that timing is precise. Its showing up in my ports under Qualcomm HS-USB QDLoader9008 as its supposed to.

Now my main issue is that I'm unable to get past a sahara error in QFIL. I get error 277 unable to read packet header, only read 0 bytes.

This is when trying to open the partition manager. I selected the options to match as best as I could. I cant seem to find the "rawprogram0.xml" file anywhere but I wasn't sure if that was required just to access the partition manager.
 

athoti

Member
Sep 25, 2018
28
4
Now my main issue is that I'm unable to get past a sahara error in QFIL. I get error 277 unable to read packet header, only read 0 bytes.
Yes I know, I've been helped at times too and very quickly. I'm definitely not a pro, only have flashed some things here and there :) but I'll try to help if I can and hopefully I don't mess things up.

All I can say is I had the "sahara error" many a times until I restarted my computer, checked for update driver in windows device manager and then it worked. At some point I had QFIL opened on one side of the screen with my mouse on Tools -> Partition manager to select that as soon as I entered phone in 9008 but I'm not sure it helped or not. Now as soon as it goes in 9008 mode I can take my jolly time, there's no need to hurry anything.

You only need to select Storage Type on the bottom: ufs, then SelectPort -> your 9008 port and select programmer -> the "prog_ufs_firehose_Sdm845_lge" file (that I placed in a folder directly on C drive and there again not sure if that was what did it) You don't need to select the flat build.

Hope it helps something.
 

Gorbieee

Member
May 12, 2021
9
0
Google Pixel
Yes I know, I've been helped at times too and very quickly. I'm definitely not a pro, only have flashed some things here and there :) but I'll try to help if I can and hopefully I don't mess things up.

All I can say is I had the "sahara error" many a times until I restarted my computer, checked for update driver in windows device manager and then it worked. At some point I had QFIL opened on one side of the screen with my mouse on Tools -> Partition manager to select that as soon as I entered phone in 9008 but I'm not sure it helped or not. Now as soon as it goes in 9008 mode I can take my jolly time, there's no need to hurry anything.

You only need to select Storage Type on the bottom: ufs, then SelectPort -> your 9008 port and select programmer -> the "prog_ufs_firehose_Sdm845_lge" file (that I placed in a folder directly on C drive and there again not sure if that was what did it) You don't need to select the flat build.

Hope it helps something.
Currently out, will try reboot when I get home. Port selection should be fine. The flat build auto populates when is elect that firehose file. Do I need the rawprogram0.xml file? If so where would I get that?

Edit: Tried reboot, no luck. Phone is currently in 9008 mode, disconnected and as soon as I connected it I tried to open the partition manager, same error. Attaching QFIL image for clarity.
 

Attachments

  • QFILStatus.PNG
    QFILStatus.PNG
    34.4 KB · Views: 9
Last edited:

AsItLies

Senior Member
Nov 4, 2009
1,029
429
tucson
Currently out, will try reboot when I get home. Port selection should be fine. The flat build auto populates when is elect that firehose file. Do I need the rawprogram0.xml file? If so where would I get that?
No, you don't need the rawprogram xml file(s), those would be needed when restoring a backup. It was really an oversight that it was on the original screens when making the guide.

it's not needed. Cheers
 

AsItLies

Senior Member
Nov 4, 2009
1,029
429
tucson
I got the laf_a and laf_b that ngowner provided here on page 12. I see they are 20e pie but they've worked for me. I went between flashing v35 eng. and deleted laf-a and b and reflashing them a number of times to try to flash twrp but no success. You're right I have fastboot when I delete them but then I can't flash anything because they're deleted ...

Here are the boot partitions. I hope I did it right? I'm not experienced with QFIL. So I went to tools -> partition manager -> boot_a -> read. Is that the way?

Thanks again!
cool, I'll get to this shortly. Yes it sounds like you did it the right way. cheers
 

AsItLies

Senior Member
Nov 4, 2009
1,029
429
tucson
I got the laf_a and laf_b that ngowner provided here on page 12. I see they are 20e pie but they've worked for me. I went between flashing v35 eng. and deleted laf-a and b and reflashing them a number of times to try to flash twrp but no success. You're right I have fastboot when I delete them but then I can't flash anything because they're deleted ...

Here are the boot partitions. I hope I did it right? I'm not experienced with QFIL. So I went to tools -> partition manager -> boot_a -> read. Is that the way?

Thanks again!

Here it is with twrp injected.

keep in mind, flash this with qfil, then exit qfil and go directly to recovery (keep vol dn and pwr pressed until u see LG logo screen, release pwr only, then repress pwr - follow 'reset' and that takes u to twrp).

once in twrp, format data, then reboot recovery, then flash magisk and dm_verity. Should be all set after that.

cheers
 
  • Like
Reactions: athoti

Gorbieee

Member
May 12, 2021
9
0
Google Pixel
you may need it, but maybe not, depends on which firmware you're on. Android 9 is the OS version, firmware is like at&t, verizon, etc etc.

cheers
Ah I see I apologize for the dumb question then. Are all of the firmwares consistent for their individual carriers?
i.e. are all verizon one firmware, all sprint a different one, all at&t a third?

This is a Sprint LGV40 Thinq but its currently still in 9008 mode and I'm nervous I wont be able to get back into it if I leave it to check the firmware XD.

This is all assuming I'm able to get past this sahara error, nothing I've tried has worked so far. Power cycled pc, tried hitting partition manager quickly after plugging the phone in, different cables, different usb ports (2.0, 3.0, 3.1, Type-C).

To be fair the error has at least been consistent, always unable to read the packet header. But its not very verbose so I cant find much information about resolving it in this forum or other places online.
 

AsItLies

Senior Member
Nov 4, 2009
1,029
429
tucson
Ah I see I apologize for the dumb question then. Are all of the firmwares consistent for their individual carriers?
i.e. are all verizon one firmware, all sprint a different one, all at&t a third?

This is a Sprint LGV40 Thinq but its currently still in 9008 mode and I'm nervous I wont be able to get back into it if I leave it to check the firmware XD.

This is all assuming I'm able to get past this sahara error, nothing I've tried has worked so far. Power cycled pc, tried hitting partition manager quickly after plugging the phone in, different cables, different usb ports (2.0, 3.0, 3.1, Type-C).

To be fair the error has at least been consistent, always unable to read the packet header. But its not very verbose so I cant find much information about resolving it in this forum or other places online.

no the firmwares aren't consistent in that sense. At&t I think went up to 30e? I know Korean Open went to 30f, Sprint I don't think has a 30x version... They are consistent in that 10x is Oreo, 20x is Pie, and 30x is android 10.

But they can't be mixed and matched, or at least it's not likely they could be. Best to stay with the same partitions for the same firmware and OS version.

You'll be able to get back into qfil, it's just kind of a bugger to do, at first, you get used to it. The sahara error is common. I know on tele group they suggest many options (some you've tried), diff usb ports, diff cable, diff driver, and even a diff pc. Also a diff qud driver as some of them are unsigned, which can cause a problem and not be obvious it's the issue.

Try this driver as it's signed and you would at least know it's not the driver...
good luck.
 

Gorbieee

Member
May 12, 2021
9
0
Google Pixel
no the firmwares aren't consistent in that sense. At&t I think went up to 30e? I know Korean Open went to 30f, Sprint I don't think has a 30x version... They are consistent in that 10x is Oreo, 20x is Pie, and 30x is android 10.

But they can't be mixed and matched, or at least it's not likely they could be. Best to stay with the same partitions for the same firmware and OS version.

You'll be able to get back into qfil, it's just kind of a bugger to do, at first, you get used to it. The sahara error is common. I know on tele group they suggest many options (some you've tried), diff usb ports, diff cable, diff driver, and even a diff pc. Also a diff qud driver as some of them are unsigned, which can cause a problem and not be obvious it's the issue.

Try this driver as it's signed and you would at least know it's not the driver...
good luck.
Appreciate the link!

Quick question, I'm assuming it would it be possible for the phone to show up in QFIL and my device manager with the unsigned driver? I know I have read people say that it being unsigned causes an issue when isntalling the driver itself, but it seems to have installed correctly. Does an unsigned driver also contribute to some sahara errors?
 

AsItLies

Senior Member
Nov 4, 2009
1,029
429
tucson
Appreciate the link!

Quick question, I'm assuming it would it be possible for the phone to show up in QFIL and my device manager with the unsigned driver? I know I have read people say that it being unsigned causes an issue when isntalling the driver itself, but it seems to have installed correctly. Does an unsigned driver also contribute to some sahara errors?
Yes, it absolutely does contribute to it. And it can be installed and if you don't catch the little flashing indication that it's not signed, you won't even know it.

I'd highly recommend just use the signed one and don't worry about it.
 

athoti

Member
Sep 25, 2018
28
4
Here it is with twrp injected.

keep in mind, flash this with qfil, then exit qfil and go directly to recovery (keep vol dn and pwr pressed until u see LG logo screen, release pwr only, then repress pwr - follow 'reset' and that takes u to twrp).

once in twrp, format data, then reboot recovery, then flash magisk and dm_verity. Should be all set after that.

cheers
Thank you so much for doing this!

For some reason it didn't quite work all the way. I got to twrp which was nice to see but then I couldn't format data and couldn't flash either magisk or lineageos properly which I tried. Lineageos was stuck in bootloop. I thought, well maybe I should erase laf_a and laf_b again. That didn't do it. I thought to reflash what you gave me and maybe erase it first. But in the process I deleted the boot partition.

So I'm stuck with a phone that only goes in EDL mode, at least it's that but then no partitions to speak of :( In QFIL partition manager is empty. Man I hate it when phone manufactures make it so hard to do this! My V30 was so easy to mess with, nothing like this V40... Any help appreciated. I'm trying to read other places to see how to get back to things. Maybe I should have asked for help before I went too far ahead on my own.
 

AsItLies

Senior Member
Nov 4, 2009
1,029
429
tucson
Thank you so much for doing this!

For some reason it didn't quite work all the way. I got to twrp which was nice to see but then I couldn't format data and couldn't flash either magisk or lineageos properly which I tried. Lineageos was stuck in bootloop. I thought, well maybe I should erase laf_a and laf_b again. That didn't do it. I thought to reflash what you gave me and maybe erase it first. But in the process I deleted the boot partition.

So I'm stuck with a phone that only goes in EDL mode, at least it's that but then no partitions to speak of :( In QFIL partition manager is empty. Man I hate it when phone manufactures make it so hard to do this! My V30 was so easy to mess with, nothing like this V40... Any help appreciated. I'm trying to read other places to see how to get back to things. Maybe I should have asked for help before I went too far ahead on my own.

Hmmm, that doesn't sound too good. So you go into part manager and there are no partitions at all? If that's the case, you'll need the tele group 'v40-unbrick'.

But first, what made you think to erase the laf partitions again? The laf partition is for one thing, lg download mode (aka lg up). In the guide it talks about erasing the laf partition which then gives u a watered down version of fastboot. But then you don't have lg up. It also has zero effect on the device booting or not booting.

So you learned something there. Now, **if** you don't have anything in partition manager, then follow the steps below from tele group:

v40unbrick:

Download (https://drive.google.com/drive/folders/1WQaaM35SWiF_UbXAM8hiRB95D2CDkIEq) the backup. Unzip it to find 7 luns (0-6).

1. Open QFIL
2. Select Flat Build
3. Click load xml and select the rawprogram(#) XML that is in the lun(0-6) folder.
4. If it asks you for a patch xml, click cancel. It's not needed to flash this backup.
5. Click download
6. Repeat steps for each lun folder

This backup I believe is ATT. I'm not aware of a Sprint one. But at least your phone would be in working order and you could then cross flash a diff rom if desired.

Also, if you want to install lineage, I'd suggest following the post in 'rom development' for lineage and also post in it if u have troubles. I've only installed lineage 1 or 2 times and can't be much help there.

cheers
 

Gorbieee

Member
May 12, 2021
9
0
Google Pixel
Yes, it absolutely does contribute to it. And it can be installed and if you don't catch the little flashing indication that it's not signed, you won't even know it.

I'd highly recommend just use the signed one and don't worry about it.
Uninstalled unsigned driver, installed the one you gave me. No dice, still getting the same sahara error. Gonna try a combination of restarts. Let me know if you think of anything I can try or have a thread to point me at. :) Appreciate the help so far, looking forward to getting past this.
 

AsItLies

Senior Member
Nov 4, 2009
1,029
429
tucson
Uninstalled unsigned driver, installed the one you gave me. No dice, still getting the same sahara error. Gonna try a combination of restarts. Let me know if you think of anything I can try or have a thread to point me at. :) Appreciate the help so far, looking forward to getting past this.

Well this is the canned response (in the tele group) to anyone that mentions a 'sahara' error:

When you get a sahara error on Qfil, change your USB port/cable.
Restart both phone and pc before trying again.
Check drivers on PC
Try reducing the COM port speed by going to device manager
Try another PC
Disable driver signature verification on Windows 10
If you run out of ideas, use a Linux installation; will save you a lot of trouble

I've gotten qfil to work on a win 8.1 laptop and a win 10 desktop, but fortunately they both have usb 2.0 ports. When I accidentally used a usb 3.0 port the data was corrupted. Qfil doesn't work under linux but there is something similar that is python based created by bkerler (edl client). That's great for doing a full backup but not so easy to flash a single partition like qfil is.

good luck
 

Gorbieee

Member
May 12, 2021
9
0
Google Pixel
Well this is the canned response (in the tele group) to anyone that mentions a 'sahara' error:

When you get a sahara error on Qfil, change your USB port/cable.
Restart both phone and pc before trying again.
Check drivers on PC
Try reducing the COM port speed by going to device manager
Try another PC
Disable driver signature verification on Windows 10
If you run out of ideas, use a Linux installation; will save you a lot of trouble

I've gotten qfil to work on a win 8.1 laptop and a win 10 desktop, but fortunately they both have usb 2.0 ports. When I accidentally used a usb 3.0 port the data was corrupted. Qfil doesn't work under linux but there is something similar that is python based created by bkerler (edl client). That's great for doing a full backup but not so easy to flash a single partition like qfil is.

good luck
Thank you for all the suggestions, I'll start knocking them out one by one. Could I use a linux installation in a VM?
 

athoti

Member
Sep 25, 2018
28
4
Hmmm, that doesn't sound too good. So you go into part manager and there are no partitions at all? If that's the case, you'll need the tele group 'v40-unbrick'.

But first, what made you think to erase the laf partitions again? The laf partition is for one thing, lg download mode (aka lg up). In the guide it talks about erasing the laf partition which then gives u a watered down version of fastboot. But then you don't have lg up. It also has zero effect on the device booting or not booting.

So you learned something there. Now, **if** you don't have anything in partition manager, then follow the steps below from tele group:

v40unbrick:

Download (https://drive.google.com/drive/folders/1WQaaM35SWiF_UbXAM8hiRB95D2CDkIEq) the backup. Unzip it to find 7 luns (0-6).

1. Open QFIL
2. Select Flat Build
3. Click load xml and select the rawprogram(#) XML that is in the lun(0-6) folder.
4. If it asks you for a patch xml, click cancel. It's not needed to flash this backup.
5. Click download
6. Repeat steps for each lun folder

This backup I believe is ATT. I'm not aware of a Sprint one. But at least your phone would be in working order and you could then cross flash a diff rom if desired.

Also, if you want to install lineage, I'd suggest following the post in 'rom development' for lineage and also post in it if u have troubles. I've only installed lineage 1 or 2 times and can't be much help there.

cheers

Thank you, I got the files but I keep getting errors at step 5, downloading. Would the log help give you any idea what it could be?

The phone only boots to EDL, that I can tell, the screen is always black. It only shows as 9008 port in device manager and QFIL. In QFIL, Tools -> Partition Manager shows everything empty. Only POWER + VOLUME DOWN pressed together seem to respond to anything.

Xsavi at the beginning mentioned something about unbricking. Is there something else I can try?
 

Attachments

  • 132656755929514821.log
    6.4 KB · Views: 3

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    @con_ritmo wrote

    Hello!

    I just purchased a v40 and would like to unlock the bootloader/twrp/magisk it.
    My v40 is att v405ua30c on android 10. So i figure it's 10c?

    I noticed that you mentioned in the v40 unlock thread that you need a specific bootloader for android 10...and provided a link to download 10e injected with twrp.

    Where would I be able to find a 10c bootloader injected with twrp?

    Thank you for any help you can provide!

    Regards

    So, the naming conventions LG uses can be a bit confusing, but android 8 was v405ua10x, and android 9 is v405ua20x and android 10 is v405ua30x. The 'x' signifies updates, which are usually just security patches.

    your v40 is att v405ua, the 30c indicates the OS version. That's the boot partition with twrp that you want, the one for att 30c.

    this is the link to that one, att 30c.

    cheers
    1
    You are absolutely correct Asitlies!

    I could not get the fastboot on my phone up when connected to my main computer. As it turns out it's an issue with that specific computer. The nuking laf was to eliminate the "user error getting into fastboot" part of the problem and just get fastboot no matter what. Once I saw that the problem still persisted, I moved on to another computer and all went well.

    Unfortunately the injected bootloader twrp didn't work for me...the phone hung on the V40 splash screen. This was done with QFIL...maybe if I had fastboot flashed it would've worked? Maybe if I had waited longer the boot wouldve gone through. At that point I figured since I was going to fastboot anyway I just decided to do the twrp process too.

    I appreciate all your help Asitlies...you've been keeping this forum alive with your expertise!!! Couldn't have done it without your posts.
    1
    I understand that sort of thing happens when you bork the partition table, usually by flashing an image to a wrong partition (the image is too big so it overwrites whats near it).

    From the tele group the solution is the v40unbrick:

    -------------------
    v40unbrick:

    Download (https://drive.google.com/drive/folders/1WQaaM35SWiF_UbXAM8hiRB95D2CDkIEq) the backup. Unzip it to find 7 luns (0-6).

    1. Open QFIL
    2. Select Flat Build
    3. Click load xml and select the rawprogram(#) XML that is in the lun(0-6) folder.
    4. If it asks you for a patch xml, click cancel. It's not needed to flash this backup.
    5. Click download
    6. Repeat steps for each lun folder.
    ---------------------

    that will at least get the phone working again, but I think the backup is at&t pie (not positive). None the less, you'll then be able to flash a kdz of your choice or find a newer backup of at&t or sprint if that's what u want to use.

    cheers

    I understand that sort of thing happens when you bork the partition table, usually by flashing an image to a wrong partition (the image is too big so it overwrites whats near it).

    From the tele group the solution is the v40unbrick:

    -------------------
    v40unbrick:

    Download (https://drive.google.com/drive/folders/1WQaaM35SWiF_UbXAM8hiRB95D2CDkIEq) the backup. Unzip it to find 7 luns (0-6).

    1. Open QFIL
    2. Select Flat Build
    3. Click load xml and select the rawprogram(#) XML that is in the lun(0-6) folder.
    4. If it asks you for a patch xml, click cancel. It's not needed to flash this backup.
    5. Click download
    6. Repeat steps for each lun folder.
    ---------------------

    that will at least get the phone working again, but I think the backup is at&t pie (not positive). None the less, you'll then be able to flash a kdz of your choice or find a newer backup of at&t or sprint if that's what u want to use.

    cheers
    Thank you for your help on this I really appreciate it!

    Ok so I didn't tell you the whole story. Lol
    I did load the wrong backup file in fastboot with the "fastboot flash abl_a c:\original boot file here\abl_a.img"
    there was an error code that said "data overflow" or something like that.

    Then I went back into qfil and deleted all 6 of the partitions (noted in the above post) and proceeded to flash back the back-up partitions not knowing that I was loading them to the wrong partitions. 2 out of the 6 said the same error "data overflow" and I proceeded anyways. Once I found that I had labeled the back-up wrong I was able to load the correct back-up .bin files to the correct partition.

    That's when I got the dim error screen upon reboot.

    Fyi My phone is Lg v40, Sprint, Pie 9.
    I will follow you instructions, thank you!
  • 44
    This Guide will explain how to unlock your LG V40 (Every variant except T-Mobile)

    Unlock Prerequisites:
    Make sure you have "Enable OEM Unlock" enabled in developer options, along with adb debugging. Very important. You'll be stuck with the red triangle otherwise. If you don't have the "Enable OEM Unlock" option in developer options, you'll have to flash frp with the v35 engineering bootloader. The frp image will be provided in the attachments section.

    QPST Download:
    It turns out the reason QFIL is failing is because it's missing quite a bit of stuff. I'm providing the zip to QPST (It's actually required) to install. QPST includes QFIL. My fault, I'm all over the place with this... Here it is (GDrive): QPST

    Booting into EDL:
    Note: This can be done while booted!

    1. Plug in your Phone to your PC

    2. Press and hold Power and Volume Down

    3. As soon as your screen blanks, rapidly start pressing volume up.

    4. If you've successfully booted into EDL, your screen will be completely blank and the device manager will show (Under COM Ports): Qualcomm HS-USB QDLoader 9008

    nQeN45t.png


    Using QFIL to Unlock Your Bootloader
    QPST should be installed, and your in 9008 plugged into your PC.

    Setting up QFIL:
    1. Launch QFIL and set your storage type to UFS. This is located at the bottom right corner of the window The LG V40 has UFS storage. The leaked loader is a loader for LG SD845 UFS devices. If you try to send the loader with your storage set to emmc, it will NOT work. By default, it is set to emmc.

    9jvV3rv.png


    2. Select the port. Click select port and select the one that says "Qualcomm HS-USB QDLoader 9008 (COM #)" That is your phone. After it is highlighted, press OK.

    3. Under select programmer, click browse, find the loader and select it.

    4. Your screen should now look like this (Minus the Flat Build Stuff, that is for total unbrick purposes):

    DmnzGBy.png


    QFIL is now all setup and ready for flashing.

    Flashing the Engineering Bootloader

    1. In the upper left hand corner of the Window, click on Tools > Partition Manager from the drop down menu

    smxXCkP.png


    2. When the Partition Manager window comes up, find "abl_a" > click on it > right click and select Manage Partition Data.

    AzuFXMm.png


    3. When the "Raw Data Manager" window comes up, there are four options to choose from (I'll tell you what each of them does):

    • Erase: Wipes the specified partition clean
    • Read Data...: Backs up the partition. It will tell you where it saved it in the log output in the main window
    • Load Image: Flashes a .img file of your choice to the specified partition
    • Close: Brings you back to the Partition Manager

    LKG7Wkg.png


    You'll be using the load image function to flash the V35 Engineering bootloader to your device.

    4. Click load image then select the V35 engineering bootloader. It will flash the image to your device.

    Unlocking Your Device:

    Now that the V35 Engineering Bootloader has been flashed to your device:

    1. Press and hold the Power and Volume Down buttons until your device reboots out of 9008. When you hear the disconnect sound, immediately hold volume down (only volume down) to enter fastboot right away (this is required for both methods, my apologies).

    2. When you've entered fastboot, execute this command:
    Code:
    fastboot oem unlock
    Userdata will be wiped as a security measure as with all android devices.

    3. While you're still in the v35 engineering bootloader flash back the stock pie bootloader (If originally on pie firmware) with:
    Code:
    fastboot flash abl_a path/to/ablpiestock.img

    The V35 Engineering bootloader is OREO only. Some people have managed to boot with this on pie firmware. But generally, you WON'T be able to boot with this flashed if you're on PIE firmware. If you're on Oreo firmware, you can leave this flashed


    4. For devices without the "Enable OEM Unlock" option, you'll need to flash frp! You can do so with (While still in V35 Bootloader):

    Code:
    fastboot flash frp path/to/frp

    4a. Reboot right back into fastboot (hold volume down after rebooting) and run:
    Code:
    fastboot oem unlock

    The reason you can't unlock your T-Mobile device is because no other bootloader/firmware will work with T-Mobile devices. Only T-Mobile firmware will work on it. If you're looking for root, avoid V405TA (T-Mobile) phones. Any other model will work for this.
    5
    Incorrectly referred to EDL than Download mode

    HI all, I just wanted to share my experience of this that may give some extra help for others going through this. But first, I'd not have got anywhere if it wasn't for a bunch of you on here, so many thanks to @Xsavi, @Ainz_Ooal_Gown, @DLS123, @LameMonster82 and many others! And I may as well pre-thank @SGCMarkus as his threads are coming soon enough...

    Ok, so my initial goal was to get root on my LG V40...

    I started with an LM-V405EBW V20a-IND-XX, so that meant I was not able to unlock the bootloader using the official LG method - I've got to admit, I liked the LG V40 phone, and it was a good price, and I thought it had developer support... I missed that it was only for one market (come on LG, please do better!)

    Anyway, challenge was set! All I really wanted was to have root... I naïvely thought a combination of @Ainz_Ooal_Gown's LGUP Guide and some KDZ tweaking from @DLS123 would get me there; however, I was about to run in to two snags: CrossDL errors and Chain of Trust issues

    So my first thought was: could I perhaps flash an EU image onto the phone and also get a bunch of security upgrades too! So I downloaded the latest one, V20e-LAO-COM. Then following @Ainz_Ooal_Gown's guide I evenutally ran into the CrossDL "Error 0x6004 OPEN_ESA_DS > OPEN_EU_DS". From searching around the only way I could force this was to use the LGUP_Cmd.exe from the LGUP v1.15 Developer version. And this worked perfectly, even though there were rumours around that such an indiscriminate flashing could be very dangerous and brick my phone - so beware and be careful!

    Ok, so now I learnt that IMEI and OEM Device-ID are a more integral part of the phone, and this flash has only brought me useful security fixes that my previous would not have - so that's good. However, I am a long way from root as my reading around this informed me that unless I could break the QCom Chain of Trust (eg. unlock the bootloader, etc.) then I was not going to get a phone that would boot up, certainly patching the boot in a KDZ image was not going to work. I saw that I could have this done remotely with those who owned an Octopusbox by hooking up via some websites or the V40 Telegram group - sadly both felt a little like giving up, and I couldn't afford one of the boxes so...

    Then I found this, @Xsavi's, guide. I ended up using the latest QPST from QPSTtool.com. I probably didn't need it, however I was getting many "Download Fail:Sahara Fail:QSaharaServer Fail:process fail" errors. I was unable to get the QFIL tool to download the partitions in the Partition Manager part of QFIL. When it works it should be very quick, but when it doesn't it will stall for a while, output some logs, and then that error (similar to the output here, although they are doing something different).
    Using the latest version of QPST seemed to fix this with the one given in this thread. But then it too started failing with the same error. So, from more reading, I started to get a feel that timing and maybe environment was important. In terms of timing, as soon as you put the phone into 9008 Mode* you need to as quickly as possible load up the Partition Manager, and in terms of environment, a freshly restarted phone put into this mode... possibly similar for the QPST tooling too... I didn't manage to repeat this to be sure.
    (* yes - 9008 Mode is a black screen, doesn't boot, doesn't seem to be on, hold <power>+<vol down> to reboot out of it. You also need to have the cable plugged it to go into this mode it seemed. And you have to be very quick once you turn the power off, pressing the <vol up> button to go into it too. You will know you got it as the phone will not turn back on, and in Windows Device Manager you will see the Qualcomm HS-USB QDLoader 9008 come up)

    I did a few things different from this guide that I'll cover here: I took a backup for the abl_a/abl_b and laf_a/laf_b partitions using QFIL. When you look at a partition you have an option to Read it too. I used this to make backups. I then used the V35 image to unlock the bootloader of the V40! (yes! success!) I then restored the abl_a I took a backup of. When I rebooted I was presented with a fastboot that was now not looking for unlocks, it wanted me to flash things. So I put the phone into Download mode, and then using LGUP I restored the V20e-LAO-COM KDZ. After a few reboots, a reset, and some processing time the LG V40 is now up and running and importantly with the bootloader still unlocked! And everything seems to be working so far...

    I realise looking back I could have cut out the CrossDL issues as everything would have been erased in the bootloader unlock. Oh and all of this was done via Windows 8.1 VM in VirtualBox: you can both download IMGs from Microsoft's site, then another part will give you the Product Keys. Anyway, hope that helps others a little bit through this too - next is to finally try out @DLS123's Magisk tutorial and I should be done, until some LineageOS desire sets in.

    Thanks again everyone! Looking forward to what can be done in this space now for this phone: 9008 Mode is amazing (and terrifying) for its scope!
    5
    Awesome! You guys are brilliant!
    So do we expect a kickstart in development (like the V30's dev scene) now that an unlock is available for everybody?

    And one last question: does this mean that we can unlock a (network) locked phone this way? I know that the usual answer is 'no', but from what I've seen around here, there's something called 'cross-flashing' of US unlocked firmware. Perhaps that means an unlock?
    If not, do online unlock services work? (I do not want any names - I just want to know whether any service at all works).

    I do apologize if my questions are stupid - it's only that with the overwhelming amount of (sometimes contradictory) posts here, I just want to make sure I'm doing everything correctly! :laugh:

    Your questions aren't stupid. :)

    Unfortunately, you can't sim unlock using this method. I'm hoping this will kickstart development for this device also, I already have a few ROMs made I have yet to release to XDA. Any 3rd party online unlock services are scams. Nowadays, everything is done server side when it comes to SIM unlocking your phone.

    No problem dude! If you have any other questions, feel free to reach out to me. I'm super active in the V40 telegram group. I'm becoming more active here too (I need to. LoL).
    3
    @Xsavi This is Awesome! I might get a V40 later in the year
    Btw a small point, the title says: Unlock your LG V40 (Via 9008) Root ONLY for T-Mobile variants.
    while guide says: his Guide will explain how to unlock your LG V40 (Every variant except T-Mobile)
    Title probably needs to be corrected :p

    Title and guide has been corrected. Thank you for the much needed suggestion!
    2
    Also getting a Download Fail, but mine reads "Download Fail:Sahara Fail:QSaharaServer Fail:process fail". My port is showing as Qualcomm HS-USB QDLoader 9008 (COM7). I was sure to try to update the driver in device manager, and am prompted that "The best drivers for your device are already installed".

    The culprit is QFIL being by itself instead of being installed with QPST.