• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

[GUIDE] Unlock your LG V40 via 9008 mode (Every Variant except T-Mobile)

Search This thread

AsItLies

Senior Member
Nov 4, 2009
1,348
523
tucson
Google Pixel 3
Is there a link for KDZ for 10 for the 405EBW? So I can do a fresh restore, I have the secure start-up on my phone on slot a and want to get rid of it. I don't know why my usual code isnt working.

Just 10 by the looks of it.

Thanks

this link has all the v40 stock roms. Yeah I didn't make that as clear as possible, re the version;

if you have android 10, then the version will be 30a, 30b etc. If it's Pie 9, it would be 20a, 20b etc. And, if it were Oreo, it would be 10a, 10b, etc

cheers
 

Zengus

Member
Sep 17, 2021
5
0
Does anyone have the abl_a and b files for the Verizon V40? I seem to have bricked my device when I loaded the V35 files without backing up. That also didn't help me unlock the bootloader at all, I was getting this error when attempting oem unlock in fastboot:

FAILED (remote: ' Set device unlocked! failed: 00000050')
fastboot: error: Command failed

(But this isn't really as important as unbricking my phone first)
 

AsItLies

Senior Member
Nov 4, 2009
1,348
523
tucson
Google Pixel 3
Does anyone have the abl_a and b files for the Verizon V40? I seem to have bricked my device when I loaded the V35 files without backing up. That also didn't help me unlock the bootloader at all, I was getting this error when attempting oem unlock in fastboot:

FAILED (remote: ' Set device unlocked! failed: 00000050')
fastboot: error: Command failed

(But this isn't really as important as unbricking my phone first)

2 things, 1) to get any of the VZW partitions it's easy, because the vzw firmware (the kdz) is publicly available. Follow this thread and you'll find instructions etc. 2) Re-read the original post, it specifically mentions 'for devices that don't have the OEM unlock setting' ... you need to flash the frp file mentioned, because vzw roms don't have that setting.

cheers
 

Lu.Rocha

New member
Sep 27, 2021
1
0
This Guide will explain how to unlock your LG V40 (Every variant except T-Mobile)

Unlock Prerequisites:
Make sure you have "Enable OEM Unlock" enabled in developer options, along with adb debugging. Very important. You'll be stuck with the red triangle otherwise. If you don't have the "Enable OEM Unlock" option in developer options, you'll have to flash frp with the v35 engineering bootloader. The frp image will be provided in the attachments section.

QPST Download:
It turns out the reason QFIL is failing is because it's missing quite a bit of stuff. I'm providing the zip to QPST (It's actually required) to install. QPST includes QFIL. My fault, I'm all over the place with this... Here it is (GDrive): QPST

Booting into EDL:
Note: This can be done while booted!

1. Plug in your Phone to your PC

2. Press and hold Power and Volume Down

3. As soon as your screen blanks, rapidly start pressing volume up.

4. If you've successfully booted into EDL, your screen will be completely blank and the device manager will show (Under COM Ports): Qualcomm HS-USB QDLoader 9008

nQeN45t.png


Using QFIL to Unlock Your Bootloader
QPST should be installed, and your in 9008 plugged into your PC.

Setting up QFIL:
1. Launch QFIL and set your storage type to UFS. This is located at the bottom right corner of the window The LG V40 has UFS storage. The leaked loader is a loader for LG SD845 UFS devices. If you try to send the loader with your storage set to emmc, it will NOT work. By default, it is set to emmc.

9jvV3rv.png


2. Select the port. Click select port and select the one that says "Qualcomm HS-USB QDLoader 9008 (COM #)" That is your phone. After it is highlighted, press OK.

3. Under select programmer, click browse, find the loader and select it.

4. Your screen should now look like this (Minus the Flat Build Stuff, that is for total unbrick purposes):

DmnzGBy.png


QFIL is now all setup and ready for flashing.

Flashing the Engineering Bootloader

1. In the upper left hand corner of the Window, click on Tools > Partition Manager from the drop down menu

smxXCkP.png


2. When the Partition Manager window comes up, find "abl_a" > click on it > right click and select Manage Partition Data.

AzuFXMm.png


3. When the "Raw Data Manager" window comes up, there are four options to choose from (I'll tell you what each of them does):

  • Erase: Wipes the specified partition clean
  • Read Data...: Backs up the partition. It will tell you where it saved it in the log output in the main window
  • Load Image: Flashes a .img file of your choice to the specified partition
  • Close: Brings you back to the Partition Manager

LKG7Wkg.png


You'll be using the load image function to flash the V35 Engineering bootloader to your device.

4. Click load image then select the V35 engineering bootloader. It will flash the image to your device.

Unlocking Your Device:

Now that the V35 Engineering Bootloader has been flashed to your device:

1. Press and hold the Power and Volume Down buttons until your device reboots out of 9008. When you hear the disconnect sound, immediately hold volume down (only volume down) to enter fastboot right away (this is required for both methods, my apologies).

2. When you've entered fastboot, execute this command:
Code:
fastboot oem unlock
Userdata will be wiped as a security measure as with all android devices.

3. While you're still in the v35 engineering bootloader flash back the stock pie bootloader (If originally on pie firmware) with:
Code:
fastboot flash abl_a path/to/ablpiestock.img

The V35 Engineering bootloader is OREO only. Some people have managed to boot with this on pie firmware. But generally, you WON'T be able to boot with this flashed if you're on PIE firmware. If you're on Oreo firmware, you can leave this flashed


4. For devices without the "Enable OEM Unlock" option, you'll need to flash frp! You can do so with (While still in V35 Bootloader):

Code:
fastboot flash frp path/to/frp

4a. Reboot right back into fastboot (hold volume down after rebooting) and run:
Code:
fastboot oem unlock

The reason you can't unlock your T-Mobile device is because no other bootloader/firmware will work with T-Mobile devices. Only T-Mobile firmware will work on it. If you're looking for root, avoid V405TA (T-Mobile) phones. Any other model will work for this.
This Guide will explain how to unlock your LG V40 (Every variant except T-Mobile)

Unlock Prerequisites:
Make sure you have "Enable OEM Unlock" enabled in developer options, along with adb debugging. Very important. You'll be stuck with the red triangle otherwise. If you don't have the "Enable OEM Unlock" option in developer options, you'll have to flash frp with the v35 engineering bootloader. The frp image will be provided in the attachments section.

QPST Download:
It turns out the reason QFIL is failing is because it's missing quite a bit of stuff. I'm providing the zip to QPST (It's actually required) to install. QPST includes QFIL. My fault, I'm all over the place with this... Here it is (GDrive): QPST

Booting into EDL:
Note: This can be done while booted!

1. Plug in your Phone to your PC

2. Press and hold Power and Volume Down

3. As soon as your screen blanks, rapidly start pressing volume up.

4. If you've successfully booted into EDL, your screen will be completely blank and the device manager will show (Under COM Ports): Qualcomm HS-USB QDLoader 9008

nQeN45t.png


Using QFIL to Unlock Your Bootloader
QPST should be installed, and your in 9008 plugged into your PC.

Setting up QFIL:
1. Launch QFIL and set your storage type to UFS. This is located at the bottom right corner of the window The LG V40 has UFS storage. The leaked loader is a loader for LG SD845 UFS devices. If you try to send the loader with your storage set to emmc, it will NOT work. By default, it is set to emmc.

9jvV3rv.png


2. Select the port. Click select port and select the one that says "Qualcomm HS-USB QDLoader 9008 (COM #)" That is your phone. After it is highlighted, press OK.

3. Under select programmer, click browse, find the loader and select it.

4. Your screen should now look like this (Minus the Flat Build Stuff, that is for total unbrick purposes):

DmnzGBy.png


QFIL is now all setup and ready for flashing.

Flashing the Engineering Bootloader

1. In the upper left hand corner of the Window, click on Tools > Partition Manager from the drop down menu

smxXCkP.png


2. When the Partition Manager window comes up, find "abl_a" > click on it > right click and select Manage Partition Data.

AzuFXMm.png


3. When the "Raw Data Manager" window comes up, there are four options to choose from (I'll tell you what each of them does):

  • Erase: Wipes the specified partition clean
  • Read Data...: Backs up the partition. It will tell you where it saved it in the log output in the main window
  • Load Image: Flashes a .img file of your choice to the specified partition
  • Close: Brings you back to the Partition Manager

LKG7Wkg.png


You'll be using the load image function to flash the V35 Engineering bootloader to your device.

4. Click load image then select the V35 engineering bootloader. It will flash the image to your device.

Unlocking Your Device:

Now that the V35 Engineering Bootloader has been flashed to your device:

1. Press and hold the Power and Volume Down buttons until your device reboots out of 9008. When you hear the disconnect sound, immediately hold volume down (only volume down) to enter fastboot right away (this is required for both methods, my apologies).

2. When you've entered fastboot, execute this command:
Code:
fastboot oem unlock
Userdata will be wiped as a security measure as with all android devices.

3. While you're still in the v35 engineering bootloader flash back the stock pie bootloader (If originally on pie firmware) with:
Code:
fastboot flash abl_a path/to/ablpiestock.img

The V35 Engineering bootloader is OREO only. Some people have managed to boot with this on pie firmware. But generally, you WON'T be able to boot with this flashed if you're on PIE firmware. If you're on Oreo firmware, you can leave this flashed


4. For devices without the "Enable OEM Unlock" option, you'll need to flash frp! You can do so with (While still in V35 Bootloader):

Code:
fastboot flash frp path/to/frp

4a. Reboot right back into fastboot (hold volume down after rebooting) and run:
Code:
fastboot oem unlock

The reason you can't unlock your T-Mobile device is because no other bootloader/firmware will work with T-Mobile devices. Only T-Mobile firmware will work on it. If you're looking for root, avoid V405TA (T-Mobile) phones. Any other model will work for this.
Hi Sir, i tried it. But i got a edl fail: "failed to switch to emergency download mode"
 

athoti

Member
Sep 25, 2018
31
4
Does anyone have the abl_a and b files for the Verizon V40? I seem to have bricked my device when I loaded the V35 files without backing up. That also didn't help me unlock the bootloader at all, I was getting this error when attempting oem unlock in fastboot:

FAILED (remote: ' Set device unlocked! failed: 00000050')
fastboot: error: Command failed

(But this isn't really as important as unbricking my phone first)
Were you able to get the abl_a and abl_b for verizon, android 10? I would appreciate if someone has them and could attach them here. Although I have the kdz I wasn't able to get those files, the LG firmware extract doesn't extract the .dz file or it glitches at that point. Thanks!
 
Last edited:

Zengus

Member
Sep 17, 2021
5
0
Were you able to get the abl_a and abl_b for verizon, android 10? I would appreciate if someone has them and could attach them here. Although I have the kdz I wasn't able to get those files, the LG firmware extract doesn't extract the .dz file or it glitches at that point. Thanks!

No, I gave up on this and only came back now when I had time, I think I'm in the same spot as you are with no abl a/b to restore a bricked unit.

My lack of experience led to this but I had wished the instructions were a bit clearer (or the right order), this phone seems to be much harder than the V20 that managed to unlock a few years back
 

AsItLies

Senior Member
Nov 4, 2009
1,348
523
tucson
Google Pixel 3
No, I gave up on this and only came back now when I had time, I think I'm in the same spot as you are with no abl a/b to restore a bricked unit.

My lack of experience led to this but I had wished the instructions were a bit clearer (or the right order), this phone seems to be much harder than the V20 that managed to unlock a few years back

Here's a gdrive link to the files u need. I just downloaded this kdz and did this for you. The boot and laf partitions are in there also.

Honestly guys, if yer having trouble with the kdz utility, u should ask in those forums for help to get it to work. It's a bit daunting, but certainly doable. I run it under linux personally, works fine once u get the dependencies resolved.

And I'd point out, where guides are concerned, it's **always** wise to read through the guide, beginning to end, at least once, before doing anything. Check for things that don't make sense, and if they seem serious enough, ask questions before proceeding.

People that write guides here don't get paid for it, and they've usually only done it with their own specific device, that's why they always have a *disclaimer* at the top.

cheers
 

Zengus

Member
Sep 17, 2021
5
0
Here's a gdrive link to the files u need. I just downloaded this kdz and did this for you. The boot and laf partitions are in there also.

Honestly guys, if yer having trouble with the kdz utility, u should ask in those forums for help to get it to work. It's a bit daunting, but certainly doable. I run it under linux personally, works fine once u get the dependencies resolved.

And I'd point out, where guides are concerned, it's **always** wise to read through the guide, beginning to end, at least once, before doing anything. Check for things that don't make sense, and if they seem serious enough, ask questions before proceeding.

People that write guides here don't get paid for it, and they've usually only done it with their own specific device, that's why they always have a *disclaimer* at the top.

cheers

I appreciate this! But it turned out it wasn't my issue after all... I can't remember anymore the series of steps that led to my situation, but I ended up with the red triangle and both slots unbootable after trying any solution I could find last week. I believe I thought I could fix it by reloading the correct abl files, but these weren't the correct ones (I don't think I remembered at all what version was on the original partition)

So I struggled a bit trying to remember what was the goal of getting the abl files, but I remembered now it was to get Download Mode working again, load a new kdz and start fresh. I managed to find two posts this time that helped:

https://forum.xda-developers.com/t/...variant-except-t-mobile.4042207/post-85203951
https://forum.xda-developers.com/t/guide-lgup-for-all-no-root-needed.3967858/post-85565917
(It took me 10mins to find the correct posts again from the 30+ tabs I have open on XDA looking for solutions)

I pushed all the files from the first link (except twrp img) onto the partition, I had issues with UPPERCUT but the second link had a patched LGUP that I was able to use to flash V405UA30C_00 (from http://lg-roms.com/ )

I was able to follow the guide steps again, but backed up abl_a first. I have bootloader unlocked and hopefully I can flash a rom now
 

AsItLies

Senior Member
Nov 4, 2009
1,348
523
tucson
Google Pixel 3
I appreciate this! But it turned out it wasn't my issue after all... I can't remember anymore the series of steps that led to my situation, but I ended up with the red triangle and both slots unbootable after trying any solution I could find last week. I believe I thought I could fix it by reloading the correct abl files, but these weren't the correct ones (I don't think I remembered at all what version was on the original partition)

So I struggled a bit trying to remember what was the goal of getting the abl files, but I remembered now it was to get Download Mode working again, load a new kdz and start fresh. I managed to find two posts this time that helped:

https://forum.xda-developers.com/t/...variant-except-t-mobile.4042207/post-85203951
https://forum.xda-developers.com/t/guide-lgup-for-all-no-root-needed.3967858/post-85565917
(It took me 10mins to find the correct posts again from the 30+ tabs I have open on XDA looking for solutions)

I pushed all the files from the first link (except twrp img) onto the partition, I had issues with UPPERCUT but the second link had a patched LGUP that I was able to use to flash V405UA30C_00 (from http://lg-roms.com/ )

I was able to follow the guide steps again, but backed up abl_a first. I have bootloader unlocked and hopefully I can flash a rom now

Well good yer making progress. But no, it's not abl that gives download (LgUp) mode, it's the laf partitions that do that.

Unfortunately some guides indicate to nuke (erase) the laf file as then, when u go to download mode, you would get a kind of 'watered' down version of fastboot. But, until u restore the original laf files, u won't have lgup.

The abl (android boot loader) is where u flash the engineering abl, and u get full blown fastboot.

it's confusing, takes time. Good luck with it.
 

kanaan360

Senior Member
Mar 9, 2015
91
7
Vidor, Texas
Okay, I attempted this. I'm guessing the engineering bootloader didn't flash right because all fastboot commands were unknown or failed (unless new versions of fastboot don't use the OEM unlock command anymore).
Booted out of the engineering bootloader on accident while trying to retry with a different USB port (2.0 Instead of 3) got a red triangle and then an automatic reboot into the stock Verizon/LG Android 10 os.

When I boot into edl/9008 mode and reflash the engineering bootloader I can't seem to boot into it by pressing volume down+power after leaving edl. I typically get to the recovery
 

Malkierian

Member
Jan 7, 2015
9
0
Took me a while to figure out that you weren't supposed to let go of the power and volume down buttons when you started pressing volume up to load EDL mode, however now that I have it, I can't load the partition manager, it keeps giving me "Download fail:Firehose Fail:FHLoader fail", and part of the error log says "ERROR: Error in handling unrecognized TAG (response)". If I wait for a minute before trying again, it gets stuck at "Program Path:" "***** Working Folder" for a while before telling me "Download fail: Sahara Fail:QSAharaServer Fail".
 

AsItLies

Senior Member
Nov 4, 2009
1,348
523
tucson
Google Pixel 3
Took me a while to figure out that you weren't supposed to let go of the power and volume down buttons when you started pressing volume up to load EDL mode, however now that I have it, I can't load the partition manager, it keeps giving me "Download fail:Firehose Fail:FHLoader fail", and part of the error log says "ERROR: Error in handling unrecognized TAG (response)". If I wait for a minute before trying again, it gets stuck at "Program Path:" "***** Working Folder" for a while before telling me "Download fail: Sahara Fail:QSAharaServer Fail".

the sahara error is, unfortunately, commonly experienced. There are numerous suggestions to fix it, seems though the most common fixes are to 1) be sure to use a usb 2.0 port 2) try different cables, ideally u want a data cable not a charging cable 3) be sure the driver you are using is signed, an unsigned one will install with a message it's not signed, it's easy to ignore. 4) some have used a different computer and gotten it to work.

Qualcomms qfil software is old software, it does work but it can be difficult to get the right combination of things correct.

cheers
 

Malkierian

Member
Jan 7, 2015
9
0
the sahara error is, unfortunately, commonly experienced. There are numerous suggestions to fix it, seems though the most common fixes are to 1) be sure to use a usb 2.0 port 2) try different cables, ideally u want a data cable not a charging cable 3) be sure the driver you are using is signed, an unsigned one will install with a message it's not signed, it's easy to ignore. 4) some have used a different computer and gotten it to work.

Qualcomms qfil software is old software, it does work but it can be difficult to get the right combination of things correct.

cheers
What about the Firehose error I get first? It's instantaneous when I try to open the partition manager the first time.
 

degarb

Member
Mar 18, 2015
24
0
quote: "
Booting into EDL:
Note: This can be done while booted!

1. Plug in your Phone to your PC

2. Press and hold Power and Volume Down

3. As soon as your screen blanks, rapidly start pressing volume up.

4. If you've successfully booted into EDL, your screen will be completely blank and the device manager will show (Under COM Ports): Qualcomm HS-USB QDLoader 9008"


This doesn't work on my LG 40, it just takes a screen shot and reboots the phone back into android.
 

Malkierian

Member
Jan 7, 2015
9
0
quote: "
Booting into EDL:
Note: This can be done while booted!

1. Plug in your Phone to your PC

2. Press and hold Power and Volume Down

3. As soon as your screen blanks, rapidly start pressing volume up.

4. If you've successfully booted into EDL, your screen will be completely blank and the device manager will show (Under COM Ports): Qualcomm HS-USB QDLoader 9008"


This doesn't work on my LG 40, it just takes a screen shot and reboots the phone back into android.
The phone has to be off before these steps are taken. I don't know why it said that they can be done while booted.
 

AsItLies

Senior Member
Nov 4, 2009
1,348
523
tucson
Google Pixel 3
The phone has to be off before these steps are taken. I don't know why it said that they can be done while booted.

In both cases, the phone off, the phone on, the phone on any screen, even if it's bootlooping...

the device can be put in edl mode.

With the phone on, and you press and HOLD the vol minus and pwr, yes, it does take a screen shot, but if u continue to hold u will get a 'count down' msg, counting down from 5 secs. Once the countdown is over and the screen blanks, u continue to hold vol minus and Pwr but also start spamming the vol plus key as quickly as u can.

When not on the phone booted screen, you press and hold vol minus and pwr and kind of 'time it' (because u won't get a 5 sec countdown screen), before spamming the vol plus key.

Getting the timing right, of when to start rapidly pressing the vol plus key is difficult, it takes practice. It can work the very first time, or it can take 5 tries.

the thing to understand about qualcomms edl mode, it's built in, it can't be disabled and it can't be 'not working'. It always works, you just have to keep trying until u get the key combo right.

cheers
 

kanaan360

Senior Member
Mar 9, 2015
91
7
Vidor, Texas
So I got a software update to the same build I was already running I'm assuming it would have rewrote my corrupt? bootloader partition. How would I check if that is the case and before I try again how can I check what slot I'm currently running in
 

AsItLies

Senior Member
Nov 4, 2009
1,348
523
tucson
Google Pixel 3
So I got a software update to the same build I was already running I'm assuming it would have rewrote my corrupt? bootloader partition. How would I check if that is the case and before I try again how can I check what slot I'm currently running in

You got a software update to the same build? Then that was probably a security update, they are usually small, only a 100 or so meg.

You're wondering if it re-wrote your corrupt bootloader partition? So, how did the phone boot (to get the update), if u have a corrupt bootloader partition?

what made u think u had a corrupt bootloader in the first place? Isn't that the same way you would 'check it'?

the only ways I know to check current slot is with twrp or fastboot.

cheers
 

kanaan360

Senior Member
Mar 9, 2015
91
7
Vidor, Texas
You got a software update to the same build? Then that was probably a security update, they are usually small, only a 100 or so meg.

You're wondering if it re-wrote your corrupt bootloader partition? So, how did the phone boot (to get the update), if u have a corrupt bootloader partition?

what made u think u had a corrupt bootloader in the first place? Isn't that the same way you would 'check it'?

the only ways I know to check current slot is with twrp or fastboot.

cheers
I flashed the engineering bootloader, rebooted without OEM unlocking and got a red triangle. Auto reboot into the system afterwards and no red triangles going forward but even if I use qfil to reflash the engineering bootloader I can't seem to get anywhere near fastboot mode, either going into lgupdown, recovery or the system

I thought my abl would be corrupted or otherwise inaccessible potentially
 

Top Liked Posts

  • There are no posts matching your filters.
  • 45
    This Guide will explain how to unlock your LG V40 (Every variant except T-Mobile)

    Unlock Prerequisites:
    Make sure you have "Enable OEM Unlock" enabled in developer options, along with adb debugging. Very important. You'll be stuck with the red triangle otherwise. If you don't have the "Enable OEM Unlock" option in developer options, you'll have to flash frp with the v35 engineering bootloader. The frp image will be provided in the attachments section.

    QPST Download:
    It turns out the reason QFIL is failing is because it's missing quite a bit of stuff. I'm providing the zip to QPST (It's actually required) to install. QPST includes QFIL. My fault, I'm all over the place with this... Here it is (GDrive): QPST

    Booting into EDL:
    Note: This can be done while booted!

    1. Plug in your Phone to your PC

    2. Press and hold Power and Volume Down

    3. As soon as your screen blanks, rapidly start pressing volume up.

    4. If you've successfully booted into EDL, your screen will be completely blank and the device manager will show (Under COM Ports): Qualcomm HS-USB QDLoader 9008

    nQeN45t.png


    Using QFIL to Unlock Your Bootloader
    QPST should be installed, and your in 9008 plugged into your PC.

    Setting up QFIL:
    1. Launch QFIL and set your storage type to UFS. This is located at the bottom right corner of the window The LG V40 has UFS storage. The leaked loader is a loader for LG SD845 UFS devices. If you try to send the loader with your storage set to emmc, it will NOT work. By default, it is set to emmc.

    9jvV3rv.png


    2. Select the port. Click select port and select the one that says "Qualcomm HS-USB QDLoader 9008 (COM #)" That is your phone. After it is highlighted, press OK.

    3. Under select programmer, click browse, find the loader and select it.

    4. Your screen should now look like this (Minus the Flat Build Stuff, that is for total unbrick purposes):

    DmnzGBy.png


    QFIL is now all setup and ready for flashing.

    Flashing the Engineering Bootloader

    1. In the upper left hand corner of the Window, click on Tools > Partition Manager from the drop down menu

    smxXCkP.png


    2. When the Partition Manager window comes up, find "abl_a" > click on it > right click and select Manage Partition Data.

    AzuFXMm.png


    3. When the "Raw Data Manager" window comes up, there are four options to choose from (I'll tell you what each of them does):

    • Erase: Wipes the specified partition clean
    • Read Data...: Backs up the partition. It will tell you where it saved it in the log output in the main window
    • Load Image: Flashes a .img file of your choice to the specified partition
    • Close: Brings you back to the Partition Manager

    LKG7Wkg.png


    You'll be using the load image function to flash the V35 Engineering bootloader to your device.

    4. Click load image then select the V35 engineering bootloader. It will flash the image to your device.

    Unlocking Your Device:

    Now that the V35 Engineering Bootloader has been flashed to your device:

    1. Press and hold the Power and Volume Down buttons until your device reboots out of 9008. When you hear the disconnect sound, immediately hold volume down (only volume down) to enter fastboot right away (this is required for both methods, my apologies).

    2. When you've entered fastboot, execute this command:
    Code:
    fastboot oem unlock
    Userdata will be wiped as a security measure as with all android devices.

    3. While you're still in the v35 engineering bootloader flash back the stock pie bootloader (If originally on pie firmware) with:
    Code:
    fastboot flash abl_a path/to/ablpiestock.img

    The V35 Engineering bootloader is OREO only. Some people have managed to boot with this on pie firmware. But generally, you WON'T be able to boot with this flashed if you're on PIE firmware. If you're on Oreo firmware, you can leave this flashed


    4. For devices without the "Enable OEM Unlock" option, you'll need to flash frp! You can do so with (While still in V35 Bootloader):

    Code:
    fastboot flash frp path/to/frp

    4a. Reboot right back into fastboot (hold volume down after rebooting) and run:
    Code:
    fastboot oem unlock

    The reason you can't unlock your T-Mobile device is because no other bootloader/firmware will work with T-Mobile devices. Only T-Mobile firmware will work on it. If you're looking for root, avoid V405TA (T-Mobile) phones. Any other model will work for this.
    5
    Incorrectly referred to EDL than Download mode

    HI all, I just wanted to share my experience of this that may give some extra help for others going through this. But first, I'd not have got anywhere if it wasn't for a bunch of you on here, so many thanks to @Xsavi, @Ainz_Ooal_Gown, @DLS123, @LameMonster82 and many others! And I may as well pre-thank @SGCMarkus as his threads are coming soon enough...

    Ok, so my initial goal was to get root on my LG V40...

    I started with an LM-V405EBW V20a-IND-XX, so that meant I was not able to unlock the bootloader using the official LG method - I've got to admit, I liked the LG V40 phone, and it was a good price, and I thought it had developer support... I missed that it was only for one market (come on LG, please do better!)

    Anyway, challenge was set! All I really wanted was to have root... I naïvely thought a combination of @Ainz_Ooal_Gown's LGUP Guide and some KDZ tweaking from @DLS123 would get me there; however, I was about to run in to two snags: CrossDL errors and Chain of Trust issues

    So my first thought was: could I perhaps flash an EU image onto the phone and also get a bunch of security upgrades too! So I downloaded the latest one, V20e-LAO-COM. Then following @Ainz_Ooal_Gown's guide I evenutally ran into the CrossDL "Error 0x6004 OPEN_ESA_DS > OPEN_EU_DS". From searching around the only way I could force this was to use the LGUP_Cmd.exe from the LGUP v1.15 Developer version. And this worked perfectly, even though there were rumours around that such an indiscriminate flashing could be very dangerous and brick my phone - so beware and be careful!

    Ok, so now I learnt that IMEI and OEM Device-ID are a more integral part of the phone, and this flash has only brought me useful security fixes that my previous would not have - so that's good. However, I am a long way from root as my reading around this informed me that unless I could break the QCom Chain of Trust (eg. unlock the bootloader, etc.) then I was not going to get a phone that would boot up, certainly patching the boot in a KDZ image was not going to work. I saw that I could have this done remotely with those who owned an Octopusbox by hooking up via some websites or the V40 Telegram group - sadly both felt a little like giving up, and I couldn't afford one of the boxes so...

    Then I found this, @Xsavi's, guide. I ended up using the latest QPST from QPSTtool.com. I probably didn't need it, however I was getting many "Download Fail:Sahara Fail:QSaharaServer Fail:process fail" errors. I was unable to get the QFIL tool to download the partitions in the Partition Manager part of QFIL. When it works it should be very quick, but when it doesn't it will stall for a while, output some logs, and then that error (similar to the output here, although they are doing something different).
    Using the latest version of QPST seemed to fix this with the one given in this thread. But then it too started failing with the same error. So, from more reading, I started to get a feel that timing and maybe environment was important. In terms of timing, as soon as you put the phone into 9008 Mode* you need to as quickly as possible load up the Partition Manager, and in terms of environment, a freshly restarted phone put into this mode... possibly similar for the QPST tooling too... I didn't manage to repeat this to be sure.
    (* yes - 9008 Mode is a black screen, doesn't boot, doesn't seem to be on, hold <power>+<vol down> to reboot out of it. You also need to have the cable plugged it to go into this mode it seemed. And you have to be very quick once you turn the power off, pressing the <vol up> button to go into it too. You will know you got it as the phone will not turn back on, and in Windows Device Manager you will see the Qualcomm HS-USB QDLoader 9008 come up)

    I did a few things different from this guide that I'll cover here: I took a backup for the abl_a/abl_b and laf_a/laf_b partitions using QFIL. When you look at a partition you have an option to Read it too. I used this to make backups. I then used the V35 image to unlock the bootloader of the V40! (yes! success!) I then restored the abl_a I took a backup of. When I rebooted I was presented with a fastboot that was now not looking for unlocks, it wanted me to flash things. So I put the phone into Download mode, and then using LGUP I restored the V20e-LAO-COM KDZ. After a few reboots, a reset, and some processing time the LG V40 is now up and running and importantly with the bootloader still unlocked! And everything seems to be working so far...

    I realise looking back I could have cut out the CrossDL issues as everything would have been erased in the bootloader unlock. Oh and all of this was done via Windows 8.1 VM in VirtualBox: you can both download IMGs from Microsoft's site, then another part will give you the Product Keys. Anyway, hope that helps others a little bit through this too - next is to finally try out @DLS123's Magisk tutorial and I should be done, until some LineageOS desire sets in.

    Thanks again everyone! Looking forward to what can be done in this space now for this phone: 9008 Mode is amazing (and terrifying) for its scope!
    5
    Awesome! You guys are brilliant!
    So do we expect a kickstart in development (like the V30's dev scene) now that an unlock is available for everybody?

    And one last question: does this mean that we can unlock a (network) locked phone this way? I know that the usual answer is 'no', but from what I've seen around here, there's something called 'cross-flashing' of US unlocked firmware. Perhaps that means an unlock?
    If not, do online unlock services work? (I do not want any names - I just want to know whether any service at all works).

    I do apologize if my questions are stupid - it's only that with the overwhelming amount of (sometimes contradictory) posts here, I just want to make sure I'm doing everything correctly! :laugh:

    Your questions aren't stupid. :)

    Unfortunately, you can't sim unlock using this method. I'm hoping this will kickstart development for this device also, I already have a few ROMs made I have yet to release to XDA. Any 3rd party online unlock services are scams. Nowadays, everything is done server side when it comes to SIM unlocking your phone.

    No problem dude! If you have any other questions, feel free to reach out to me. I'm super active in the V40 telegram group. I'm becoming more active here too (I need to. LoL).
    3
    @Xsavi This is Awesome! I might get a V40 later in the year
    Btw a small point, the title says: Unlock your LG V40 (Via 9008) Root ONLY for T-Mobile variants.
    while guide says: his Guide will explain how to unlock your LG V40 (Every variant except T-Mobile)
    Title probably needs to be corrected :p

    Title and guide has been corrected. Thank you for the much needed suggestion!
    3
    Also getting a Download Fail, but mine reads "Download Fail:Sahara Fail:QSaharaServer Fail:process fail". My port is showing as Qualcomm HS-USB QDLoader 9008 (COM7). I was sure to try to update the driver in device manager, and am prompted that "The best drivers for your device are already installed".