[GUIDE] Unlock your LG V40 via 9008 mode (Every Variant except T-Mobile)

Search This thread

El Quick

New member
Feb 3, 2022
1
0
Great Guide, I applied on a V405UA from Sprint and is OK.

Is there any way to carrier unlock this same model?
 

newonsh

New member
Mar 5, 2016
3
0
Hi all. I'm hoping someone is still listening. I know it's an old thread but I'm a die hard V series fan. When i finally smashed the screen on my V30 i picked up a used V40 on ebay about a month ago. My v30 was the Canadian version which was pretty locked down. I've traditionally put custom ROMs on my phones so I was keen to get a US version of the V40 (it wasn't sold in Canada anyway). I have the Sprint V405UA.

Here's my issue. I went through this guide and everything worked fine until I entered Fastboot mode and tried "fastbook oem unlock". I had fastboot/adb installed system wide and a fastboot terminal shortcut on my desktop with OEM Unlock and USB debugging enabled. I entered the unlock command and it did nothing, just said "waiting for any device". After a couple mins I closed the terminal and opened it again and tried "fastboot devices", nothing, then "adb devices" and the phone rebooted to a secure startup screen asking for a PIN. I tried my usuals but they didn't work. I assume because it was a used phone and probably someone else's PIN. I hard reset with the buttons (volume +, power) and it booted up normally. I went though the process again, 9008, flash v35 eng over abl_a, Qfil confirmed "send image", but I simply cannot enter fastboot mode anymore. I tried holding volume -, power until the disconnect sound and letting go of power, I tried plugging in the cable while holding volume -. It always boots up normally. I've switched between USB 3 and USB 2 ports, nothing. The last thing I did was erase laf_a and laf_b and repeated flashing v35 eng and it still won't boot to fastboot, just boots into the OS normally. Oh and I'm on Android 9. The only difference is there is no Sprint load animation on power up or down anymore.

Am I missing something? I'd love to get Lineage or something on this as I've had lots of bugs with the bloated LG junk. But I'm at a loss right now. Thanks in advance for any advice.
 

AsItLies

Senior Member
Nov 4, 2009
1,578
590
tucson
Samsung Galaxy S10
Hi all. I'm hoping someone is still listening. I know it's an old thread but I'm a die hard V series fan. When i finally smashed the screen on my V30 i picked up a used V40 on ebay about a month ago. My v30 was the Canadian version which was pretty locked down. I've traditionally put custom ROMs on my phones so I was keen to get a US version of the V40 (it wasn't sold in Canada anyway). I have the Sprint V405UA.

Here's my issue. I went through this guide and everything worked fine until I entered Fastboot mode and tried "fastbook oem unlock". I had fastboot/adb installed system wide and a fastboot terminal shortcut on my desktop with OEM Unlock and USB debugging enabled. I entered the unlock command and it did nothing, just said "waiting for any device". After a couple mins I closed the terminal and opened it again and tried "fastboot devices", nothing, then "adb devices" and the phone rebooted to a secure startup screen asking for a PIN. I tried my usuals but they didn't work. I assume because it was a used phone and probably someone else's PIN. I hard reset with the buttons (volume +, power) and it booted up normally. I went though the process again, 9008, flash v35 eng over abl_a, Qfil confirmed "send image", but I simply cannot enter fastboot mode anymore. I tried holding volume -, power until the disconnect sound and letting go of power, I tried plugging in the cable while holding volume -. It always boots up normally. I've switched between USB 3 and USB 2 ports, nothing. The last thing I did was erase laf_a and laf_b and repeated flashing v35 eng and it still won't boot to fastboot, just boots into the OS normally. Oh and I'm on Android 9. The only difference is there is no Sprint load animation on power up or down anymore.

Am I missing something? I'd love to get Lineage or something on this as I've had lots of bugs with the bloated LG junk. But I'm at a loss right now. Thanks in advance for any advice.

Sounds like you've been able to get the phone into fastboot mode, and it said fastboot on the phone screen?

Assuming that's the case, then it's a windows problem. Look in device manager and you'll see an entry with an '!' mark next to it, it will usually say 'Android'. Right click it and load your LG usb driver for ADB for it and then it will recognize the device.

Be aware though, there are no custom roms you can put on and still have functioning VOlte and VOwifi. LG uses a proprietary IMS stack, thus when you lose stock, you lose the ability for VOlte also.

cheers
 

Jitteryheart87

New member
Mar 6, 2021
3
0
LG V40
@con_ritmo wrote

Hello!

I just purchased a v40 and would like to unlock the bootloader/twrp/magisk it.
My v40 is att v405ua30c on android 10. So i figure it's 10c?

I noticed that you mentioned in the v40 unlock thread that you need a specific bootloader for android 10...and provided a link to download 10e injected with twrp.

Where would I be able to find a 10c bootloader injected with twrp?

Thank you for any help you can provide!

Regards

So, the naming conventions LG uses can be a bit confusing, but android 8 was v405ua10x, and android 9 is v405ua20x and android 10 is v405ua30x. The 'x' signifies updates, which are usually just security patches.

your v40 is att v405ua, the 30c indicates the OS version. That's the boot partition with twrp that you want, the one for att 30c.

this is the link to that one, att 30c.

cheersdo you have that one for the verizon phone??
 

Jitteryheart87

New member
Mar 6, 2021
3
0
LG V40
@con_ritmo wrote

Hello!

I just purchased a v40 and would like to unlock the bootloader/twrp/magisk it.
My v40 is att v405ua30c on android 10. So i figure it's 10c?

I noticed that you mentioned in the v40 unlock thread that you need a specific bootloader for android 10...and provided a link to download 10e injected with twrp.

Where would I be able to find a 10c bootloader injected with twrp?

Thank you for any help you can provide!

Regards

So, the naming conventions LG uses can be a bit confusing, but android 8 was v405ua10x, and android 9 is v405ua20x and android 10 is v405ua30x. The 'x' signifies updates, which are usually just security patches.

your v40 is att v405ua, the 30c indicates the OS version. That's the boot partition with twrp that you want, the one for att 30c.

this is the link to that one, att 30c.

cheers
mine is the verizon one, My v40 is
V405UA30c_00_VZW_US_OP_0814.kdz
v405ua30c on android 10 but i dont have OEM unlock anywhere in the developer options?? how do i fix this? anyone?
 

Jitteryheart87

New member
Mar 6, 2021
3
0
LG V40
It says how to in the very first post. Look for where it talks about FRP.
ok so i unlocked the bootloader but now even though im on android 10 its a bit weird because some of my apps like netflix are not compatible and im unable to download?
also how do i twrp/magisk this thing now? sorry im really new to this its my first time so i apolegize if im a bit slow here
 

teeboz

Member
Apr 19, 2007
31
1
Since unlocking and rooting i am unable to get into fastboot mode. When i use abd command it reboots normal.
 

AsItLies

Senior Member
Nov 4, 2009
1,578
590
tucson
Samsung Galaxy S10
Since unlocking and rooting i am unable to get into fastboot mode. When i use abd command it reboots normal.

So it may be the directions don't necessarily make it clear, but, there are 2 ways you can get fastboot on the v40, which doesn't normally come with it. One is to use the engineering abl, which you did, when unlocking the BL.

But, that engineering abl is for Oreo, or rather, it's Oreo based, so it won't boot the device (most times) unless you're running Oreo. That's why the directions tell you to flash back your original abl, so the device can boot. Now do you see why you no longer have fastboot? You removed the engineering abl, obviously.

The second way to get (a watered down version of) fastboot is to erase the laf partition. What the rom does, when you try to go to LGUP (which is the laf partition), because there's nothing there, it will go to a watered down version of fastboot. It's kind of worthless though, as most rom variants only give you a version that can't flash a partition, certainly can't lock / unlock the BL, etc.

There are numerous ways to 'work around' this issue, the directions only mention the erase laf. But if you put your original abl back, which you should do so it can boot, that's why you don't have fastboot any longer.
 
  • Like
Reactions: shannester

teeboz

Member
Apr 19, 2007
31
1
So it may be the directions don't necessarily make it clear, but, there are 2 ways you can get fastboot on the v40, which doesn't normally come with it. One is to use the engineering abl, which you did, when unlocking the BL.

But, that engineering abl is for Oreo, or rather, it's Oreo based, so it won't boot the device (most times) unless you're running Oreo. That's why the directions tell you to flash back your original abl, so the device can boot. Now do you see why you no longer have fastboot? You removed the engineering abl, obviously.

The second way to get (a watered down version of) fastboot is to erase the laf partition. What the rom does, when you try to go to LGUP (which is the laf partition), because there's nothing there, it will go to a watered down version of fastboot. It's kind of worthless though, as most rom variants only give you a version that can't flash a partition, certainly can't lock / unlock the BL, etc.

There are numerous ways to 'work around' this issue, the directions only mention the erase laf. But if you put your original abl back, which you should do so it can boot, that's why you don't have fastboot any longer.
thank you for this explanation. i no longer see abl_a in qfil but do have a backup of it.
 
Last edited:

RedBux

Senior Member
Jun 20, 2008
314
21
Dear Mr. Xsavi

I am using Lenovo Z6 Pro with 8GB Ram + 128 ROM + SD 855 which I bought in early 2019 being using ROW 11.0.405. This ROW Roms' which has NO Further development. Which was stop years ago.

Since this model having 3rd party developments recently (about two weeks) I requested Lenovo for bootloader unlock key @ https://www.zui.com/iunlock.

Till this date NO respond at all. I wrote to lenovo customer service pertaining the above issue still NO respond at all.

I wrote this "cos I would like you Mr. Xsavi ( or friend of yours ) whom having knowledge to produce somthing that enable me to Unlock my Bootloader

Thanking you in advance
Thanks
Regards
 

AsItLies

Senior Member
Nov 4, 2009
1,578
590
tucson
Samsung Galaxy S10
Dear Mr. Xsavi

I am using Lenovo Z6 Pro with 8GB Ram + 128 ROM + SD 855 which I bought in early 2019 being using ROW 11.0.405. This ROW Roms' which has NO Further development. Which was stop years ago.

Since this model having 3rd party developments recently (about two weeks) I requested Lenovo for bootloader unlock key @ https://www.zui.com/iunlock.

Till this date NO respond at all. I wrote to lenovo customer service pertaining the above issue still NO respond at all.

I wrote this "cos I would like you Mr. Xsavi ( or friend of yours ) whom having knowledge to produce somthing that enable me to Unlock my Bootloader

Thanking you in advance
Thanks
Regards

The reasons this guide works, to unlock the bootloader, are because of the availability of two specific files for this device:

1) The Engineering ABL specifically for this device. It doesn't work on other devices.
2) The programmers firehose, again, specifically for this device. It is a signed file, specific, so that qfil has access to the device.

Does your phone have these specific files for your device? No? Then there is no amount of writing a guide for you, because the guide won't work.

It's not a matter of simply 'writing a guide', you have to have the files.

You would be much better off finding the forums for your device, look for threads about how to get the BL unlock code, it may be they've just stopped making it available? I've no idea.

But Xsavi can't help you,, no one here can help you.
 

saiankun

Member
Jun 15, 2022
8
0
C:\Program Files (x86)\Minimal ADB and Fastboot>fastboot flash frp path/to/frp
error: cannot load 'path/to/frp': No such file or directory

C:\Program Files (x86)\Minimal ADB and Fastboot>fastboot flash abl_a path/to/ablpiestock.img
error: cannot load 'path/to/ablpiestock.img': No such file or directory
help
 

AsItLies

Senior Member
Nov 4, 2009
1,578
590
tucson
Samsung Galaxy S10
C:\Program Files (x86)\Minimal ADB and Fastboot>fastboot flash frp path/to/frp
error: cannot load 'path/to/frp': No such file or directory

C:\Program Files (x86)\Minimal ADB and Fastboot>fastboot flash abl_a path/to/ablpiestock.img
error: cannot load 'path/to/ablpiestock.img': No such file or directory
help
When the guide says 'path/to/ablpiestock.img' it's a generic path, not the actual path you type in.

what you type in would be **your** path, on your computer, to where you put your abl backup.
 

saiankun

Member
Jun 15, 2022
8
0
thanks already unlocked now you can tell me a rom and the tutorial v405ua verizom variant.
 
Last edited:

soupgoblin

New member
Jun 21, 2022
1
0
old thread, I know, but if anyone could help me it'd be much appreciated. the Programmer Path is greyed out for me. I've tried restarting the phone and installing three different versions of QPST, none of them work. I have the driver installed. please help so I can get this phone rooted!

edit: for some reason, it requires a contents.xml file. I created a blank contents.xml file and it opened up the Programmer Path. does anyone know where I can get that?
 

Attachments

  • qpst.PNG
    qpst.PNG
    51.8 KB · Views: 10

saiankun

Member
Jun 15, 2022
8
0
old thread, I know, but if anyone could help me it'd be much appreciated. the Programmer Path is greyed out for me. I've tried restarting the phone and installing three different versions of QPST, none of them work. I have the driver installed. please help so I can get this phone rooted!

edit: for some reason, it requires a contents.xml file. I created a blank contents.xml file and it opened up the Programmer Path. does anyone know where I can get that?
Select Flat build
 

Top Liked Posts

  • There are no posts matching your filters.
  • 47
    This Guide will explain how to unlock your LG V40 (Every variant except T-Mobile)

    Unlock Prerequisites:
    Make sure you have "Enable OEM Unlock" enabled in developer options, along with adb debugging. Very important. You'll be stuck with the red triangle otherwise. If you don't have the "Enable OEM Unlock" option in developer options, you'll have to flash frp with the v35 engineering bootloader. The frp image will be provided in the attachments section.

    QPST Download:
    It turns out the reason QFIL is failing is because it's missing quite a bit of stuff. I'm providing the zip to QPST (It's actually required) to install. QPST includes QFIL. My fault, I'm all over the place with this... Here it is (GDrive): QPST

    Booting into EDL:
    Note: This can be done while booted!

    1. Plug in your Phone to your PC

    2. Press and hold Power and Volume Down

    3. As soon as your screen blanks, rapidly start pressing volume up.

    4. If you've successfully booted into EDL, your screen will be completely blank and the device manager will show (Under COM Ports): Qualcomm HS-USB QDLoader 9008

    nQeN45t.png


    Using QFIL to Unlock Your Bootloader
    QPST should be installed, and your in 9008 plugged into your PC.

    Setting up QFIL:
    1. Launch QFIL and set your storage type to UFS. This is located at the bottom right corner of the window The LG V40 has UFS storage. The leaked loader is a loader for LG SD845 UFS devices. If you try to send the loader with your storage set to emmc, it will NOT work. By default, it is set to emmc.

    9jvV3rv.png


    2. Select the port. Click select port and select the one that says "Qualcomm HS-USB QDLoader 9008 (COM #)" That is your phone. After it is highlighted, press OK.

    3. Under select programmer, click browse, find the loader and select it.

    4. Your screen should now look like this (Minus the Flat Build Stuff, that is for total unbrick purposes):

    DmnzGBy.png


    QFIL is now all setup and ready for flashing.

    Flashing the Engineering Bootloader

    1. In the upper left hand corner of the Window, click on Tools > Partition Manager from the drop down menu

    smxXCkP.png


    2. When the Partition Manager window comes up, find "abl_a" > click on it > right click and select Manage Partition Data.

    AzuFXMm.png


    3. When the "Raw Data Manager" window comes up, there are four options to choose from (I'll tell you what each of them does):

    • Erase: Wipes the specified partition clean
    • Read Data...: Backs up the partition. It will tell you where it saved it in the log output in the main window
    • Load Image: Flashes a .img file of your choice to the specified partition
    • Close: Brings you back to the Partition Manager

    LKG7Wkg.png


    You'll be using the load image function to flash the V35 Engineering bootloader to your device.

    4. Click load image then select the V35 engineering bootloader. It will flash the image to your device.

    Unlocking Your Device:

    Now that the V35 Engineering Bootloader has been flashed to your device:

    1. Press and hold the Power and Volume Down buttons until your device reboots out of 9008. When you hear the disconnect sound, immediately hold volume down (only volume down) to enter fastboot right away (this is required for both methods, my apologies).

    2. When you've entered fastboot, execute this command:
    Code:
    fastboot oem unlock
    Userdata will be wiped as a security measure as with all android devices.

    3. While you're still in the v35 engineering bootloader flash back the stock pie bootloader (If originally on pie firmware) with:
    Code:
    fastboot flash abl_a path/to/ablpiestock.img

    The V35 Engineering bootloader is OREO only. Some people have managed to boot with this on pie firmware. But generally, you WON'T be able to boot with this flashed if you're on PIE firmware. If you're on Oreo firmware, you can leave this flashed


    4. For devices without the "Enable OEM Unlock" option, you'll need to flash frp! You can do so with (While still in V35 Bootloader):

    Code:
    fastboot flash frp path/to/frp

    4a. Reboot right back into fastboot (hold volume down after rebooting) and run:
    Code:
    fastboot oem unlock

    The reason you can't unlock your T-Mobile device is because no other bootloader/firmware will work with T-Mobile devices. Only T-Mobile firmware will work on it. If you're looking for root, avoid V405TA (T-Mobile) phones. Any other model will work for this.
    5
    Incorrectly referred to EDL than Download mode

    HI all, I just wanted to share my experience of this that may give some extra help for others going through this. But first, I'd not have got anywhere if it wasn't for a bunch of you on here, so many thanks to @Xsavi, @Ainz_Ooal_Gown, @DLS123, @LameMonster82 and many others! And I may as well pre-thank @SGCMarkus as his threads are coming soon enough...

    Ok, so my initial goal was to get root on my LG V40...

    I started with an LM-V405EBW V20a-IND-XX, so that meant I was not able to unlock the bootloader using the official LG method - I've got to admit, I liked the LG V40 phone, and it was a good price, and I thought it had developer support... I missed that it was only for one market (come on LG, please do better!)

    Anyway, challenge was set! All I really wanted was to have root... I naïvely thought a combination of @Ainz_Ooal_Gown's LGUP Guide and some KDZ tweaking from @DLS123 would get me there; however, I was about to run in to two snags: CrossDL errors and Chain of Trust issues

    So my first thought was: could I perhaps flash an EU image onto the phone and also get a bunch of security upgrades too! So I downloaded the latest one, V20e-LAO-COM. Then following @Ainz_Ooal_Gown's guide I evenutally ran into the CrossDL "Error 0x6004 OPEN_ESA_DS > OPEN_EU_DS". From searching around the only way I could force this was to use the LGUP_Cmd.exe from the LGUP v1.15 Developer version. And this worked perfectly, even though there were rumours around that such an indiscriminate flashing could be very dangerous and brick my phone - so beware and be careful!

    Ok, so now I learnt that IMEI and OEM Device-ID are a more integral part of the phone, and this flash has only brought me useful security fixes that my previous would not have - so that's good. However, I am a long way from root as my reading around this informed me that unless I could break the QCom Chain of Trust (eg. unlock the bootloader, etc.) then I was not going to get a phone that would boot up, certainly patching the boot in a KDZ image was not going to work. I saw that I could have this done remotely with those who owned an Octopusbox by hooking up via some websites or the V40 Telegram group - sadly both felt a little like giving up, and I couldn't afford one of the boxes so...

    Then I found this, @Xsavi's, guide. I ended up using the latest QPST from QPSTtool.com. I probably didn't need it, however I was getting many "Download Fail:Sahara Fail:QSaharaServer Fail:process fail" errors. I was unable to get the QFIL tool to download the partitions in the Partition Manager part of QFIL. When it works it should be very quick, but when it doesn't it will stall for a while, output some logs, and then that error (similar to the output here, although they are doing something different).
    Using the latest version of QPST seemed to fix this with the one given in this thread. But then it too started failing with the same error. So, from more reading, I started to get a feel that timing and maybe environment was important. In terms of timing, as soon as you put the phone into 9008 Mode* you need to as quickly as possible load up the Partition Manager, and in terms of environment, a freshly restarted phone put into this mode... possibly similar for the QPST tooling too... I didn't manage to repeat this to be sure.
    (* yes - 9008 Mode is a black screen, doesn't boot, doesn't seem to be on, hold <power>+<vol down> to reboot out of it. You also need to have the cable plugged it to go into this mode it seemed. And you have to be very quick once you turn the power off, pressing the <vol up> button to go into it too. You will know you got it as the phone will not turn back on, and in Windows Device Manager you will see the Qualcomm HS-USB QDLoader 9008 come up)

    I did a few things different from this guide that I'll cover here: I took a backup for the abl_a/abl_b and laf_a/laf_b partitions using QFIL. When you look at a partition you have an option to Read it too. I used this to make backups. I then used the V35 image to unlock the bootloader of the V40! (yes! success!) I then restored the abl_a I took a backup of. When I rebooted I was presented with a fastboot that was now not looking for unlocks, it wanted me to flash things. So I put the phone into Download mode, and then using LGUP I restored the V20e-LAO-COM KDZ. After a few reboots, a reset, and some processing time the LG V40 is now up and running and importantly with the bootloader still unlocked! And everything seems to be working so far...

    I realise looking back I could have cut out the CrossDL issues as everything would have been erased in the bootloader unlock. Oh and all of this was done via Windows 8.1 VM in VirtualBox: you can both download IMGs from Microsoft's site, then another part will give you the Product Keys. Anyway, hope that helps others a little bit through this too - next is to finally try out @DLS123's Magisk tutorial and I should be done, until some LineageOS desire sets in.

    Thanks again everyone! Looking forward to what can be done in this space now for this phone: 9008 Mode is amazing (and terrifying) for its scope!
    5
    Awesome! You guys are brilliant!
    So do we expect a kickstart in development (like the V30's dev scene) now that an unlock is available for everybody?

    And one last question: does this mean that we can unlock a (network) locked phone this way? I know that the usual answer is 'no', but from what I've seen around here, there's something called 'cross-flashing' of US unlocked firmware. Perhaps that means an unlock?
    If not, do online unlock services work? (I do not want any names - I just want to know whether any service at all works).

    I do apologize if my questions are stupid - it's only that with the overwhelming amount of (sometimes contradictory) posts here, I just want to make sure I'm doing everything correctly! :laugh:

    Your questions aren't stupid. :)

    Unfortunately, you can't sim unlock using this method. I'm hoping this will kickstart development for this device also, I already have a few ROMs made I have yet to release to XDA. Any 3rd party online unlock services are scams. Nowadays, everything is done server side when it comes to SIM unlocking your phone.

    No problem dude! If you have any other questions, feel free to reach out to me. I'm super active in the V40 telegram group. I'm becoming more active here too (I need to. LoL).
    3
    @Xsavi This is Awesome! I might get a V40 later in the year
    Btw a small point, the title says: Unlock your LG V40 (Via 9008) Root ONLY for T-Mobile variants.
    while guide says: his Guide will explain how to unlock your LG V40 (Every variant except T-Mobile)
    Title probably needs to be corrected :p

    Title and guide has been corrected. Thank you for the much needed suggestion!
    3
    Also getting a Download Fail, but mine reads "Download Fail:Sahara Fail:QSaharaServer Fail:process fail". My port is showing as Qualcomm HS-USB QDLoader 9008 (COM7). I was sure to try to update the driver in device manager, and am prompted that "The best drivers for your device are already installed".