# [GUIDE] Unlock your LG V40 via 9008 mode (Every Variant except T-Mobile)

##### New member
So without the 'enable oem unlock', follow the directions and be sure to flash the 'frp' indicated.

To get to edl mode is difficult at first. With the phone booted, press and hold both vol minus and pwr buttons. Continue to hold them and when u see the 'count down' screen, wait until it reaches 0 and the screen blanks, then quickly start pressing vol up on and off as quickly as u can (continue to hold the other 2 keys down).

If the phone goes blank and stays there, you're in edl mode. If it reboots, try again. Many people, even those with experience doing this, find it takes several tries.

cheers
Thank you--the issue I was having was that I wasn't holding down the volume down + power buttons while also tapping the volume up button. With your help, I was able to get into 9008 mode, and then load and flash the V35 image to my device.

However, I'm now struggling to get my phone to properly fastboot. When leaving 9008 mode, I hold down the volume down key, but the phone seems to start as normal, and fastboot devices doesn't detect anything. Am I supposed to hold down any other keys aside from volume down after restarting the phone out of 9008 mode? And--if I fail to get into fastboot after flashing the image initially, do I need to re-flash it every time?

Thanks so much (to whoever offers any more advice).

#### AsItLies

##### Senior Member
Thank you--the issue I was having was that I wasn't holding down the volume down + power buttons while also tapping the volume up button. With your help, I was able to get into 9008 mode, and then load and flash the V35 image to my device.

However, I'm now struggling to get my phone to properly fastboot. When leaving 9008 mode, I hold down the volume down key, but the phone seems to start as normal, and fastboot devices doesn't detect anything. Am I supposed to hold down any other keys aside from volume down after restarting the phone out of 9008 mode? And--if I fail to get into fastboot after flashing the image initially, do I need to re-flash it every time?

Thanks so much (to whoever offers any more advice).

Which partition(s) did u flash the v35 abl to? abl a and b? See, if u don't know which is the **current** slot (which one is booting), then u have to flash it to both.

Also! and don't forget or miss this, ea of the current abl (a and b) need to be backed up first. This is because the phone (almost assuredly) won't boot with the engineering abl (it's Oreo). So, u flash it, use it, then flash the original abl's back (so the phone will boot).

Some, myself included, will use fastboot to find the current slot, then flash the v35 eng abl to the other slots abl. That way you can use twrp to switch slots, reboot bootloader, use fastboot for whatever, then use fastboot to set the other slot active and reboot.

a bit tedious but it works with least amount of hassle.

##### New member
Which partition(s) did u flash the v35 abl to? abl a and b? See, if u don't know which is the **current** slot (which one is booting), then u have to flash it to both.

Also! and don't forget or miss this, ea of the current abl (a and b) need to be backed up first. This is because the phone (almost assuredly) won't boot with the engineering abl (it's Oreo). So, u flash it, use it, then flash the original abl's back (so the phone will boot).

Some, myself included, will use fastboot to find the current slot, then flash the v35 eng abl to the other slots abl. That way you can use twrp to switch slots, reboot bootloader, use fastboot for whatever, then use fastboot to set the other slot active and reboot.

a bit tedious but it works with least amount of hassle.

I totally missed 1) needing to flash the V35 to abl_a AND abl_b, and 2) needing to back up my abls...so thankfully, I did both those things, and voila, I'm in fastboot.

EDIT: Except it doesn't seem my abl backups are actually doing anything when I try to reflash them, so now I'm stuck in red triangle of doom mode...oh, dear.
EDIT2: Somehow, I managed to back up...the V35 abl, not my actual abls, because of course I did. I'll see if I can recover from this oopsie.
EDIT3: After a long, long struggle, I have managed to get the phone working again. Always make sure you're backing up the right files, fellas.

Except now I'm encountering two errors--I can't run fastboot oem unlock because, well, I don't have the "enable OEM unlock" function. So I try to flash the frp, but when I do that, I get a fastboot: error: cannot load 'C:\path\to\frp': Permission denied. (EDIT 4 because I'm stupid: I was running fastboot as an administrator, and I'm on Windows 10). Searching through this thread, I saw that some people also encountered this issue, but I didn't see a solution, and looking in general, it seems the solution is to remove any sort of lock screen on the phone--but this phone is newly factory reset, and doesn't have a lock screen. Would TWRP help fix this issue? (I'm honestly a bit lost on how I'd get TWRP working, but the internet is my friend...)

Last edited:

#### AsItLies

##### Senior Member
I totally missed 1) needing to flash the V35 to abl_a AND abl_b, and 2) needing to back up my abls...so thankfully, I did both those things, and voila, I'm in fastboot.

EDIT: Except it doesn't seem my abl backups are actually doing anything when I try to reflash them, so now I'm stuck in red triangle of doom mode...oh, dear.
EDIT2: Somehow, I managed to back up...the V35 abl, not my actual abls, because of course I did. I'll see if I can recover from this oopsie.
EDIT3: After a long, long struggle, I have managed to get the phone working again. Always make sure you're backing up the right files, fellas.

Except now I'm encountering two errors--I can't run fastboot oem unlock because, well, I don't have the "enable OEM unlock" function. So I try to flash the frp, but when I do that, I get a fastboot: error: cannot load 'C:\path\to\frp': Permission denied. (EDIT 4 because I'm stupid: I was running fastboot as an administrator, and I'm on Windows 10). Searching through this thread, I saw that some people also encountered this issue, but I didn't see a solution, and looking in general, it seems the solution is to remove any sort of lock screen on the phone--but this phone is newly factory reset, and doesn't have a lock screen. Would TWRP help fix this issue? (I'm honestly a bit lost on how I'd get TWRP working, but the internet is my friend...)

Well, this one is something you'll remember...

the guide is written in a kind of generic way, in some cases. This part is one of those cases. When it says to flash the frp, it uses a 'generic path' to indicate where the file is, because the guide can't know where, on your computer, you put the file. So when it says \path\to\frp it means your path to where u put the frp file.

cheers

##### New member
Well, this one is something you'll remember...

the guide is written in a kind of generic way, in some cases. This part is one of those cases. When it says to flash the frp, it uses a 'generic path' to indicate where the file is, because the guide can't know where, on your computer, you put the file. So when it says \path\to\frp it means your path to where u put the frp file.

cheers
Hi--

I actually was using the correct path--I simply made it path/to/frp in order to protect my privacy, haha. But I've realized the actual error I'm running into is...thanks to me not having a USB 2.0 cable. Sometimes, it's a simple as that.

Unfortunately, with my attempt to try again, I found that even when I properly backed up my abl partitions, my phone wasn't able to boot when I re-flashed them (gave me the "all slots are unavailable"). Until I get a USB 2.0 cable, I'm stuck, and unless I can figure out why my correct ABL partitions aren't letting me reboot, I'm probably gonna take a break on this (work is busy, haha). Still--thank you for all the help, because I wouldn't have been able to get this far without it.

#### AsItLies

##### Senior Member
Hi--

I actually was using the correct path--I simply made it path/to/frp in order to protect my privacy, haha. But I've realized the actual error I'm running into is...thanks to me not having a USB 2.0 cable. Sometimes, it's a simple as that.

Unfortunately, with my attempt to try again, I found that even when I properly backed up my abl partitions, my phone wasn't able to boot when I re-flashed them (gave me the "all slots are unavailable"). Until I get a USB 2.0 cable, I'm stuck, and unless I can figure out why my correct ABL partitions aren't letting me reboot, I'm probably gonna take a break on this (work is busy, haha). Still--thank you for all the help, because I wouldn't have been able to get this far without it.

I see, well that's serious privacy

Almost assuredly, your backups are corrupted, if u used a usb 3.0 port. You're on verizon 10 right? I'll look around and see if someone has posted those abl partitions. Luckily, vzw makes their kdz available, so worst case scenario they can be extracted from the kdz.

Edit to add: Use this link for vzw 30c v40 abl, boot, laf partitions. They can be used for either slot but, keep in mind, these are version 30c, if you have 30d they will probably work. If not will have to try to find 30d.

My new laptop doesn't have usb 2.0 either, have to gerry-rig a usb 2.0 cable with adapters to make it work like 2.0 in a 3.0 port. pia.

cheers

Last edited:

#### AamirXtreme

##### Senior Member
Hi, My Lg v40q Verizon doesn't have Enable OEM Unlock option in Developer mode. I am trying to flash FRP in fast mode but I get different errors. Can someone explain "fastboot flash frp path/to/frp" this command? Will it be used as it is or will it be edited to add path of frp?

#### AsItLies

##### Senior Member
Hi, My Lg v40q Verizon doesn't have Enable OEM Unlock option in Developer mode. I am trying to flash FRP in fast mode but I get different errors. Can someone explain "fastboot flash frp path/to/frp" this command? Will it be used as it is or will it be edited to add path of frp?

It has to be edited to be 'Your Path' to the frp file. It's generic, because the author doesn't know that path names on your computer

AamirXtreme

#### AamirXtreme

##### Senior Member
It has to be edited to be 'Your Path' to the frp file. It's generic, because the author doesn't know that path names on your computer
Thanks, after flashing frp i am still getting " Flashing Unlock is not allowed" error.

Edit: Unlocked the device however stuck in Faltboat even after flasing stock abl.

Last edited:

#### baosbth

##### Member
Help :
???????????? fastboott

#### AamirXtreme

##### Senior Member
Help :
???????????? fastboott
Try different version of adb/fastboot. Seen similar issue with minimal adb and fastboot.

#### baosbth

##### Member
Hãy thử phiên bản khác của adb / fastboot. Gặp sự cố tương tự với adb và fastboot tối thiểu.

can you give me a file?

#### AamirXtreme

##### Senior Member
OEM Unlock Enabled?

#### AamirXtreme

##### Senior Member
In fastboot mode restart your phone and as soon as phone turns off execute unlocking command. You'll see "waiting for device " in fastboot. Hold vol - button to enter fastboot on restart to enter fastboot. As soon as fastboot detects phone it'll execute command successfully.

#### AsItLies

##### Senior Member

It's a bit difficult to figure out what yer trying to do, but a couple of notes:

1) there is no valid command called 'fastboot oem devices'. The command to verify the devices is 'seen' by fastboot is simply: 'fastboot devices'.

2) If you type the fastboot command to unlock the bootloader, and the response is 'already unlocked', then there's nothing more to do, it's unlocked. That's easily verifiable, just reboot the device and if you have a screen with a yellow exclamation mark that tells you 'bootloader unlocked, can't verify' etc etc, then that is confirmation the B/L is unlocked and yer done with that part.

cheers

### Top Liked Posts

• There are no posts matching your filters.
• 1
Well noted. Thanks so much! I encountered another problem: after successfully installing TWRP and running it, I flashed SU for root and now when I boot the device it says DECRYPTION UNCESSFUL but when I press reset, it comes back to the same thing.

why would u want to use SU? Virtually everyone, for years, has been using magisk. And there are tons of magisk modules that help with so many things.

One thing you should always do after getting twrp is flash dm-verity-force-encrypt (then u won't get decryption errors) and flash magisk.
• 45
This Guide will explain how to unlock your LG V40 (Every variant except T-Mobile)

Unlock Prerequisites:
Make sure you have "Enable OEM Unlock" enabled in developer options, along with adb debugging. Very important. You'll be stuck with the red triangle otherwise. If you don't have the "Enable OEM Unlock" option in developer options, you'll have to flash frp with the v35 engineering bootloader. The frp image will be provided in the attachments section.

It turns out the reason QFIL is failing is because it's missing quite a bit of stuff. I'm providing the zip to QPST (It's actually required) to install. QPST includes QFIL. My fault, I'm all over the place with this... Here it is (GDrive): QPST

Booting into EDL:
Note: This can be done while booted!

2. Press and hold Power and Volume Down

3. As soon as your screen blanks, rapidly start pressing volume up.

4. If you've successfully booted into EDL, your screen will be completely blank and the device manager will show (Under COM Ports): Qualcomm HS-USB QDLoader 9008

QPST should be installed, and your in 9008 plugged into your PC.

Setting up QFIL:
1. Launch QFIL and set your storage type to UFS. This is located at the bottom right corner of the window The LG V40 has UFS storage. The leaked loader is a loader for LG SD845 UFS devices. If you try to send the loader with your storage set to emmc, it will NOT work. By default, it is set to emmc.

2. Select the port. Click select port and select the one that says "Qualcomm HS-USB QDLoader 9008 (COM #)" That is your phone. After it is highlighted, press OK.

3. Under select programmer, click browse, find the loader and select it.

4. Your screen should now look like this (Minus the Flat Build Stuff, that is for total unbrick purposes):

QFIL is now all setup and ready for flashing.

1. In the upper left hand corner of the Window, click on Tools > Partition Manager from the drop down menu

2. When the Partition Manager window comes up, find "abl_a" > click on it > right click and select Manage Partition Data.

3. When the "Raw Data Manager" window comes up, there are four options to choose from (I'll tell you what each of them does):

• Erase: Wipes the specified partition clean
• Read Data...: Backs up the partition. It will tell you where it saved it in the log output in the main window
• Load Image: Flashes a .img file of your choice to the specified partition
• Close: Brings you back to the Partition Manager

4. Click load image then select the V35 engineering bootloader. It will flash the image to your device.

Now that the V35 Engineering Bootloader has been flashed to your device:

1. Press and hold the Power and Volume Down buttons until your device reboots out of 9008. When you hear the disconnect sound, immediately hold volume down (only volume down) to enter fastboot right away (this is required for both methods, my apologies).

2. When you've entered fastboot, execute this command:
Code:
fastboot oem unlock
Userdata will be wiped as a security measure as with all android devices.

3. While you're still in the v35 engineering bootloader flash back the stock pie bootloader (If originally on pie firmware) with:
Code:
fastboot flash abl_a path/to/ablpiestock.img

The V35 Engineering bootloader is OREO only. Some people have managed to boot with this on pie firmware. But generally, you WON'T be able to boot with this flashed if you're on PIE firmware. If you're on Oreo firmware, you can leave this flashed

4. For devices without the "Enable OEM Unlock" option, you'll need to flash frp! You can do so with (While still in V35 Bootloader):

Code:
fastboot flash frp path/to/frp

4a. Reboot right back into fastboot (hold volume down after rebooting) and run:
Code:
fastboot oem unlock

The reason you can't unlock your T-Mobile device is because no other bootloader/firmware will work with T-Mobile devices. Only T-Mobile firmware will work on it. If you're looking for root, avoid V405TA (T-Mobile) phones. Any other model will work for this.
5

HI all, I just wanted to share my experience of this that may give some extra help for others going through this. But first, I'd not have got anywhere if it wasn't for a bunch of you on here, so many thanks to @Xsavi, @Ainz_Ooal_Gown, @DLS123, @LameMonster82 and many others! And I may as well pre-thank @SGCMarkus as his threads are coming soon enough...

Ok, so my initial goal was to get root on my LG V40...

I started with an LM-V405EBW V20a-IND-XX, so that meant I was not able to unlock the bootloader using the official LG method - I've got to admit, I liked the LG V40 phone, and it was a good price, and I thought it had developer support... I missed that it was only for one market (come on LG, please do better!)

Anyway, challenge was set! All I really wanted was to have root... I naïvely thought a combination of @Ainz_Ooal_Gown's LGUP Guide and some KDZ tweaking from @DLS123 would get me there; however, I was about to run in to two snags: CrossDL errors and Chain of Trust issues

So my first thought was: could I perhaps flash an EU image onto the phone and also get a bunch of security upgrades too! So I downloaded the latest one, V20e-LAO-COM. Then following @Ainz_Ooal_Gown's guide I evenutally ran into the CrossDL "Error 0x6004 OPEN_ESA_DS > OPEN_EU_DS". From searching around the only way I could force this was to use the LGUP_Cmd.exe from the LGUP v1.15 Developer version. And this worked perfectly, even though there were rumours around that such an indiscriminate flashing could be very dangerous and brick my phone - so beware and be careful!

Ok, so now I learnt that IMEI and OEM Device-ID are a more integral part of the phone, and this flash has only brought me useful security fixes that my previous would not have - so that's good. However, I am a long way from root as my reading around this informed me that unless I could break the QCom Chain of Trust (eg. unlock the bootloader, etc.) then I was not going to get a phone that would boot up, certainly patching the boot in a KDZ image was not going to work. I saw that I could have this done remotely with those who owned an Octopusbox by hooking up via some websites or the V40 Telegram group - sadly both felt a little like giving up, and I couldn't afford one of the boxes so...

Then I found this, @Xsavi's, guide. I ended up using the latest QPST from QPSTtool.com. I probably didn't need it, however I was getting many "Download Fail:Sahara Fail:QSaharaServer Failrocess fail" errors. I was unable to get the QFIL tool to download the partitions in the Partition Manager part of QFIL. When it works it should be very quick, but when it doesn't it will stall for a while, output some logs, and then that error (similar to the output here, although they are doing something different).
Using the latest version of QPST seemed to fix this with the one given in this thread. But then it too started failing with the same error. So, from more reading, I started to get a feel that timing and maybe environment was important. In terms of timing, as soon as you put the phone into 9008 Mode* you need to as quickly as possible load up the Partition Manager, and in terms of environment, a freshly restarted phone put into this mode... possibly similar for the QPST tooling too... I didn't manage to repeat this to be sure.
(* yes - 9008 Mode is a black screen, doesn't boot, doesn't seem to be on, hold <power>+<vol down> to reboot out of it. You also need to have the cable plugged it to go into this mode it seemed. And you have to be very quick once you turn the power off, pressing the <vol up> button to go into it too. You will know you got it as the phone will not turn back on, and in Windows Device Manager you will see the Qualcomm HS-USB QDLoader 9008 come up)

I did a few things different from this guide that I'll cover here: I took a backup for the abl_a/abl_b and laf_a/laf_b partitions using QFIL. When you look at a partition you have an option to Read it too. I used this to make backups. I then used the V35 image to unlock the bootloader of the V40! (yes! success!) I then restored the abl_a I took a backup of. When I rebooted I was presented with a fastboot that was now not looking for unlocks, it wanted me to flash things. So I put the phone into Download mode, and then using LGUP I restored the V20e-LAO-COM KDZ. After a few reboots, a reset, and some processing time the LG V40 is now up and running and importantly with the bootloader still unlocked! And everything seems to be working so far...

I realise looking back I could have cut out the CrossDL issues as everything would have been erased in the bootloader unlock. Oh and all of this was done via Windows 8.1 VM in VirtualBox: you can both download IMGs from Microsoft's site, then another part will give you the Product Keys. Anyway, hope that helps others a little bit through this too - next is to finally try out @DLS123's Magisk tutorial and I should be done, until some LineageOS desire sets in.

Thanks again everyone! Looking forward to what can be done in this space now for this phone: 9008 Mode is amazing (and terrifying) for its scope!
5
Awesome! You guys are brilliant!
So do we expect a kickstart in development (like the V30's dev scene) now that an unlock is available for everybody?

And one last question: does this mean that we can unlock a (network) locked phone this way? I know that the usual answer is 'no', but from what I've seen around here, there's something called 'cross-flashing' of US unlocked firmware. Perhaps that means an unlock?
If not, do online unlock services work? (I do not want any names - I just want to know whether any service at all works).

I do apologize if my questions are stupid - it's only that with the overwhelming amount of (sometimes contradictory) posts here, I just want to make sure I'm doing everything correctly! :laugh:

Unfortunately, you can't sim unlock using this method. I'm hoping this will kickstart development for this device also, I already have a few ROMs made I have yet to release to XDA. Any 3rd party online unlock services are scams. Nowadays, everything is done server side when it comes to SIM unlocking your phone.

No problem dude! If you have any other questions, feel free to reach out to me. I'm super active in the V40 telegram group. I'm becoming more active here too (I need to. LoL).
3
@Xsavi This is Awesome! I might get a V40 later in the year
Btw a small point, the title says: Unlock your LG V40 (Via 9008) Root ONLY for T-Mobile variants.
while guide says: his Guide will explain how to unlock your LG V40 (Every variant except T-Mobile)
Title probably needs to be corrected

Title and guide has been corrected. Thank you for the much needed suggestion!
3
Also getting a Download Fail, but mine reads "Download Fail:Sahara Fail:QSaharaServer Failrocess fail". My port is showing as Qualcomm HS-USB QDLoader 9008 (COM7). I was sure to try to update the driver in device manager, and am prompted that "The best drivers for your device are already installed".