H915 - Installing Lineage 18.1 (Unlock Bootloader, TWRP, Root Optional)

Search This thread

Cryovenom

Member
Dec 5, 2020
16
3
Hi All,

With the recent launch of LineageOS 18.1 I decided to take the plunge and get it installed on my fully stock Videotron/Freedom H915. Since I had to smash together info from a half dozen other threads, I figured I'd gather it all together here for folks with a Canadian phone trying to make this work.

Since I knew absolutely nothing coming into this, I'm going to go a little more detailed on this write-up. If you've been flashing ROMs since the old days of Cyanogenmod you can probably skim half of this.

Disclaimer : I'm not responsible for any bricked phones or other negative outcomes. This is what worked for me, but I'm far from being an expert. If you continue past this point you agree to take your time, do your reading, be responsible for your own device/actions and not hold me or the forum accountable for anything that might go wrong. You've been warned.

IMPORTANT NOTE #1
If you've picked up an H915 on ebay and you are intending to use it on a network other than the one it's SIM locked on, make sure you do the whole SIM unlock process on the stock ROM either before you get started at all, or once you've reverted to the vulnerable stock ROM after Step 1 below.

I actually use Telus as my provider and I wasted a bunch of time trying to figure out why I couldn't get signal because only the stock ROM will prompt you for a SIM Unlock code. Lineage will just sit there dumbly and not allow you to enable data.

Once you've unlocked the SIM it will stay unlocked from that point forward, just make sure to unlock it and verify your SIM is working with LTE on the stock ROM before you get started.

IMPORTANT NOTE #2
Use LGUP's "DUMP" feature to take a backup of ALL partitions on your phone before you start. If you're reading this thinking "I just bought this phone off ebay, there's nothing on it I care about", take the backup anyway. You never know when you might need a copy of the modem partitions or other things from your phone's original build. It came in super handy for me in troubleshooting the process. So go do a backup!


Current Issues:
  • If signal is too weak to connect to a tower (or non-existent), the OS tends to crash with a modem error. Still trying to figure this one out.
  • I think I can get this working without first jumping to US996 but haven't had a chance to verify that. If I do I'll update the thread.


Download Prerequisites
Links working as of 2021-06-29
  • LGUP with patch
  • Working adb/fastboot environment
  • Fastboot Drivers
  • Universal ADB Driver
  • Videotron/Freedom H915 Android 7 (Nougat) version E - H91510e_00_VTR_CA_OP_1205.kdz
  • USA General US996 Android 7 (Nougat) version F - US99610f_00_1205.kdz
  • APK for Terminal Emulator
  • LG V20 Root Package Original (v4?)
  • Old TWRP for Root Package
  • Videotron/Freedom H915 Modem Partition Image
  • Lineage Install Zip for H910 (grab the latest, I'm using lineage-18.1-20210506-nightly-h910-signed.zip which is already out of date)
  • MindTheGapps
  • (Optional, for rooting) Magisk

Different Boot Modes
For those not familiar with these phones, there are three different "modes" the phone can boot into. Here's a quick reference on how to boot into each one.

Download Mode
This mode is used for pushing KDZ files or individual partition backups using LGUP
  1. Turn Off Phone
  2. Hold the Up-Volume Button
  3. Insert USB-C Cable with other end already plugged into PC

Bootloader (aka Fastboot) Mode
The H915 doesn't come with this mode by default. If you try it, you'll just get battery charging. We'll be temporarily converting the phone to a US996 in order to use the DirtySanta exploit to replace the bootloader partition with a leaked Engineering aboot.

This mode is used with the fastboot tool to load the TWRP utility into the Recovery partition.
  1. Turn Off Phone
  2. Hold the Down-Volume Button
  3. Insert USB-C Cable with other end already plugged into PC

Recovery Mode
The recovery mode on a stock phone is used to perform a factory reset. We will be using the Factory Reset a couple times with the stock ROMs, then replacing the contents of the recovery partition with the TWRP tool that allows us to format partitions, load partition images, and sideload apps and LineageOS itself.
  1. Turn Off Phone
  2. Hold the Down-Volume Button
  3. Press and hold Power-On (rear fingerprint sensor/button). When LG Logo appears, release power button for 1 second then press and hold again
  4. When "Factory Data Reset" appears, release all buttons
  5. Press Volume Down to highlight "Yes" then press power button to select the option
  6. Repeat for the confirmation

Note about flashing KDZ files using LGUP

You can flash KDZ files onto the phone using LGUP from two places - either with the phone in "Download Mode", or with the phone booted into the OS with the USB Options set to "File Transfer" and USB Debugging turned on.

The difference between these two is when it performs the OS compatibility check.

In Download Mode it's the code of the Download Mode partition that does the check. In the OS, it's the OS that does the check before booting to Download Mode and bypassing Download Mode's check.

Why is this important? Because when converting from one phone to another (Say, an H915 to a US996 like we do below), you initially can't flash the KDZ using LGUP's "Upgrade" function. You can only use "Partition DL" to replace the contents of partitions with the contents of the KDZ. This kind of works, but ends up with a phone that will sometimes identify as a H915 (in Download Mode) but sometimes identify as a US996 (in the OS). To clean it up, once you've done the Partition DL method, you can do it again from the OS and use the Upgrade method to get a really clean install.

It works going back the other way as well when you want to return to stock.

If this doesn't make sense, don't worry. You don't need to fully understand it to follow the instructions below, I just found it to be interesting info that didn't seem to appear in other threads.


Process Overview
  1. Revert the phone to an old/vulnerable stock Nougat ROM for Videotron/Freedom Mobile
  2. Enable Dev Options
  3. Dump contents of US996 KDZ partitions over top of existing partitions
  4. Cleanup by re-flashing US996 KDZ partitions over top of existing partitions
  5. Transfer files to the SDCard and install Terminal Emulator
  6. Unlock the Bootloader using the DirtySanta exploit
  7. Boot to old TWRP and install new TWRP
  8. Boot to new TWRP, install LineageOS, Google Apps, and flash modem partition image
  9. Reboot to LineageOS

Actual Process

1 - Revert the phone to an old/vulnerable stock Nougat ROM for Videotron/Freedom Mobile
We need to be on Nougat for this to work, so if you're on Oreo you have to downgrade to Nougat before we begin. I chose a Nougat ROM for the H915 that's vulnerable to the DirtySanta exploit because I know it works and because I'm hoping in the future to be able to skip converting the phone to a US996 if possible.
  • Boot phone into Download Mode
  • Launch LGUP with Patch
  • Select "Upgrade" radio button
  • Select bin file : H91510e_00_VTR_CA_OP_1205.kdz
  • Click Start
  • When finished phone will reboot

1.5 - Do this if Step 1 Failed... Otherwise continue to Step 2
Depending on what's loaded on your phone when you start, it might complain about doing Step 1. This should allow us to bypass the issue and allow Step 1 to work. You can use this step if you've already converted the phone to another model as long as it's not bricked.
  • Boot phone into download mode
  • Launch LGIP with Patch
  • Select "PartitionDL" radio button
  • Select bin file : H91510e_00_VTR_CA_OP_1205.kdz
  • Click Start
  • Click the "Select All" partitions checkbox and click OK. When done it will reboot.
  • If it hangs or loops on reboot, boot into "Recovery Mode" (which at this point will Factory Reset the OS)
  • The phone boots into the OS
  • Quickly go through setup wizard. Skip as many things as possible.
  • Go Settings - General - About Phone - Software Info - Make sure it identifies as H91510e
  • Change the USB Option mode to "File Transfer"
  • Then repeat Step 1, but from inside the OS instead of in Download Mode

2 - Enable Dev Options and File Transfer Mode
We need these enabled after every time we flash the OS so that our LGUP and adb commands will work. You'll get used to doing these steps a bunch.
  • Quickly go through setup wizard. Skip as many things as possible.
  • Unplug USB-C cable
  • Swipe down from the top and change from USB Charging mode to File Transfer mode
  • Settings - General - About Phone - Software Info
  • Tap on Build Number many times until it unlocks Developer Mode
  • Go back 2 menus and enter the new "Developer Options" menus
  • Make sure "Enable OEM Unlock" is enabled
  • Enable "USB Debugging" (will be greyed out if USB-C cable is still attached)
  • Go back to main screen
  • Plug USB-C cable back in.
  • A pop-up will appear asking to Allow USB Debugging. Check the "Always Allow" box and tap OK

3 - Dump contents of US996 KDZ partitions over top of existing partition
The Videotron/Freedom KDZ has no Bootloader/Fastboot mode. If you try to enter bootloader mode you'll just end up charging the battery. So we have to cross-flash the US996 KDZ to get a phone with a bootloader which we can then replace with the engineering version using the DirtySanta exploit.
  • Boot phone into download mode
  • Launch LGUP with Patch
  • Select "PartitionDL" radio button
  • Select bin file : US99610f_00_1205.kdz
  • Click Start
  • Click the "Select All" partitions checkbox and click OK
  • When the phone boots back into the OS, repeat all of Step 2.
    • Note: If it asks for a password on startup, follow the "Boot to Recovery" steps and since
      we don't have anything loaded in the recovery partition it will wipe/erase the phone
      and remove the password.

4 - Cleanup by re-flashing US996 KDZ partitions over top of existing partitions
As mentioned in the "Note about flashing KDZ files using LGUP" section above, after you use the PartitionDL method you get a kind of dirty phone image that doesn't always identify as its new model. To clean up, we repeat the process in Upgrade Mode, taking advantage of the fact that at least the OS now identifies as US996 even if Download Mode doesn't. After this, Download Mode will also identify as US996.
  • Starting booted into the OS with a USB-C cable attached (File Transfer mode, USB Debugging on):
  • Launch LGUP with Patch
  • Select "Upgrade" radio button
  • Select bin file : US99610f_00_1205.kdz
  • Click Start
  • When the phone boots back into the OS, repeat all of Step 2.

5 - Transfer files to the SDCard and install Terminal Emulator
We will need some files on the SDCard in the phone in order to install them, either inside the OS (in the case of Terminal Emulator), or later on from TWRP. The Terminal Emulator will be used for the DirtySanta exploit so we need to get that installed now.
  • Make sure the USB Connection is set to Data Transfer mode and copy the following files to the SDCard:
    • APK for Terminal Emulator
    • twrp-3.5.1_9-0-us996.img
    • h915freedommobilemodem.img
  • Enable installing apps from unknown sources by:
    • Settings - General - Fingerprints and Security - Unknown sources (turn it On)
  • Install Terminal Emulator:
    • Tools - File Manager
    • Choose "Allow" when prompted
    • Click the up-arrow next to "Internal Storage"
    • Choose SD Card
    • Scroll down and tap on jackpal.androidterm-1.0.70-71-minAPI4.apk
    • Install

6 - Unlock the Bootloader using the DirtySanta exploit
The US996 KDZ has a bootloader but it's locked. In order to unlock it we need to use the DirtySanta exploit to give us permissions to replace the Bootloader/Fastboot with a leaked engineering version.

  • Starting booted into the OS with a USB-C cable attached (File Transfer mode, USB Debugging on):
  • Settings - General - About Phone - Software Info
  • Verify that Software Version lists as US99610f
  • Copy the twrp-3.0.2-1-us996.img file into the folder containing the LG V20 Root Package
  • Open a command prompt window and change to the folder containing the LG V20 Root Package and run "Step1.bat"
    • It will push multiple files to the phone and apply some patches/exploits.
    • This proces will take 5 minutes and put you out at an "elsa:/ $" prompt
  • At this "elsa:/ $" prompt in your command prompt window type the following:
run-as con chmod 0777 /storage/emulated/0/*
  • On the phone, launch Terminal Emulator and run the following:
id

  • Verify that the string which comes back contains the string "context-u:r:untrusted_app".
    • If not, run Step1.bat again, else continue forward
  • Enter the follosing command into Terminal Emulator (be very careful to type it properly):
applypatch /system/bin/atd /storage/emulated/0/dirtysanta

  • If that command came back with an error, close and re-open Terminal Emulator and try again
  • The command should begin to patch another file. This will take 5 minutes and will return you to the "elsa:/ $" prompt in Terminal Emulator when it has finished
  • Open another command prompt to the same folder and run "Step2.bat"
    • This step will download backup copies of the boot and aboot partitions from the phone then boot the phone into bootloader/fastboot mode.
    • You'll know it worked if the first line at the top of the phone screen appears in red
  • In the command prompt window, run Step3.bat
    • It will flash boot1.img and the TWRP Recovery image multiple times then restart the phone
  • The phone will hang, no matter how long it's left. Wait 5 minutes (at least until the logo re-loads once) then do the following:
    • Unplug the USB-C cable
    • Remove the battery from the phone to turn it off
    • Replace the battery
    • Boot into Fastboot mode and run the following commands in your command prompt:
fastboot flash boot bootbackup.img

  • Remove the USB-C cable and battery to turn off the phone. Then replace the battery and enter Recovery Mode
    • The phone will show a big red exclamation mark saying "Your device is corrupt". This is normal. It will go away after a few seconds then boot into recovery. This error screen is the result of the engineering "aboot" image that was flashed to give us an unlocked bootloader and will always happen on boot.
7 - Boot to old TWRP and install new TWRP
The old version of TWRP recovery will load. Don't ask me why we can't just go straight to new TWRP above, it didn't work well when I tried it.
  • If it asks for a password to decrypt data, click Cancel
  • Swipe to allow modifications
  • Install - Select Storage - MicroSD Card - OK
  • Install Image - Scroll down and tap the "twrp-3.5.1_9-0-us996.img"
  • Select the Recovery partition and swipe to confirm flash
  • Back to main menu
  • Reboot - Recovery

8 - Boot to new TWRP, install LineageOS, Google Apps, and flash modem partition image
The new version of TWRP will load:
  • Check the "Never show this screen during boot again" box
  • Swipe to allow modifications
  • Wipe - Format Data - type "yes" to continue
  • This is likely to fail the first time. Repeat it to properly format the data partition.
  • Go back to Main Menu - Wipe - Advanced Wipe - Select "Dalvik / ART Cache", "System", and "Cache"
  • Swipe to wipe
  • Back to main menu
  • Advanced - ADB Sideload
  • Plug in USB-C cable
  • Swipe to start sideload
  • In command prompt window on PC type the following:
adb sideload lineage-18.1-20210506-nightly-h910-signed.zip
  • When complete tap "back" and "ADB Sideload" and swipe again to apply another file:
adb sideload MindTheGapps-11.0.0-arm64-20210412_124247.zip
  • If you want to root the phone (completely optional, not necessary for this process), now is the time to do it. Tap "back" and "ADB Sideload" and swipe again to apply another file:
adb sideload Magisk-v23.zip
  • Go back to main menu - Install - Install Image - tap the h915freedommobilemodem.img file
  • Select the Modem partition and swipe to confirm flash
  • Remove USB-C cable

9. Reboot to LineageOS
  • Go back to main menu - Reboot - System - Swipe to reboot


References where I got the info to make this tutorial
 
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 2
    Hi All,

    With the recent launch of LineageOS 18.1 I decided to take the plunge and get it installed on my fully stock Videotron/Freedom H915. Since I had to smash together info from a half dozen other threads, I figured I'd gather it all together here for folks with a Canadian phone trying to make this work.

    Since I knew absolutely nothing coming into this, I'm going to go a little more detailed on this write-up. If you've been flashing ROMs since the old days of Cyanogenmod you can probably skim half of this.

    Disclaimer : I'm not responsible for any bricked phones or other negative outcomes. This is what worked for me, but I'm far from being an expert. If you continue past this point you agree to take your time, do your reading, be responsible for your own device/actions and not hold me or the forum accountable for anything that might go wrong. You've been warned.

    IMPORTANT NOTE #1
    If you've picked up an H915 on ebay and you are intending to use it on a network other than the one it's SIM locked on, make sure you do the whole SIM unlock process on the stock ROM either before you get started at all, or once you've reverted to the vulnerable stock ROM after Step 1 below.

    I actually use Telus as my provider and I wasted a bunch of time trying to figure out why I couldn't get signal because only the stock ROM will prompt you for a SIM Unlock code. Lineage will just sit there dumbly and not allow you to enable data.

    Once you've unlocked the SIM it will stay unlocked from that point forward, just make sure to unlock it and verify your SIM is working with LTE on the stock ROM before you get started.

    IMPORTANT NOTE #2
    Use LGUP's "DUMP" feature to take a backup of ALL partitions on your phone before you start. If you're reading this thinking "I just bought this phone off ebay, there's nothing on it I care about", take the backup anyway. You never know when you might need a copy of the modem partitions or other things from your phone's original build. It came in super handy for me in troubleshooting the process. So go do a backup!


    Current Issues:
    • If signal is too weak to connect to a tower (or non-existent), the OS tends to crash with a modem error. Still trying to figure this one out.
    • I think I can get this working without first jumping to US996 but haven't had a chance to verify that. If I do I'll update the thread.


    Download Prerequisites
    Links working as of 2021-06-29
    • LGUP with patch
    • Working adb/fastboot environment
    • Fastboot Drivers
    • Universal ADB Driver
    • Videotron/Freedom H915 Android 7 (Nougat) version E - H91510e_00_VTR_CA_OP_1205.kdz
    • USA General US996 Android 7 (Nougat) version F - US99610f_00_1205.kdz
    • APK for Terminal Emulator
    • LG V20 Root Package Original (v4?)
    • Old TWRP for Root Package
    • Videotron/Freedom H915 Modem Partition Image
    • Lineage Install Zip for H910 (grab the latest, I'm using lineage-18.1-20210506-nightly-h910-signed.zip which is already out of date)
    • MindTheGapps
    • (Optional, for rooting) Magisk

    Different Boot Modes
    For those not familiar with these phones, there are three different "modes" the phone can boot into. Here's a quick reference on how to boot into each one.

    Download Mode
    This mode is used for pushing KDZ files or individual partition backups using LGUP
    1. Turn Off Phone
    2. Hold the Up-Volume Button
    3. Insert USB-C Cable with other end already plugged into PC

    Bootloader (aka Fastboot) Mode
    The H915 doesn't come with this mode by default. If you try it, you'll just get battery charging. We'll be temporarily converting the phone to a US996 in order to use the DirtySanta exploit to replace the bootloader partition with a leaked Engineering aboot.

    This mode is used with the fastboot tool to load the TWRP utility into the Recovery partition.
    1. Turn Off Phone
    2. Hold the Down-Volume Button
    3. Insert USB-C Cable with other end already plugged into PC

    Recovery Mode
    The recovery mode on a stock phone is used to perform a factory reset. We will be using the Factory Reset a couple times with the stock ROMs, then replacing the contents of the recovery partition with the TWRP tool that allows us to format partitions, load partition images, and sideload apps and LineageOS itself.
    1. Turn Off Phone
    2. Hold the Down-Volume Button
    3. Press and hold Power-On (rear fingerprint sensor/button). When LG Logo appears, release power button for 1 second then press and hold again
    4. When "Factory Data Reset" appears, release all buttons
    5. Press Volume Down to highlight "Yes" then press power button to select the option
    6. Repeat for the confirmation

    Note about flashing KDZ files using LGUP

    You can flash KDZ files onto the phone using LGUP from two places - either with the phone in "Download Mode", or with the phone booted into the OS with the USB Options set to "File Transfer" and USB Debugging turned on.

    The difference between these two is when it performs the OS compatibility check.

    In Download Mode it's the code of the Download Mode partition that does the check. In the OS, it's the OS that does the check before booting to Download Mode and bypassing Download Mode's check.

    Why is this important? Because when converting from one phone to another (Say, an H915 to a US996 like we do below), you initially can't flash the KDZ using LGUP's "Upgrade" function. You can only use "Partition DL" to replace the contents of partitions with the contents of the KDZ. This kind of works, but ends up with a phone that will sometimes identify as a H915 (in Download Mode) but sometimes identify as a US996 (in the OS). To clean it up, once you've done the Partition DL method, you can do it again from the OS and use the Upgrade method to get a really clean install.

    It works going back the other way as well when you want to return to stock.

    If this doesn't make sense, don't worry. You don't need to fully understand it to follow the instructions below, I just found it to be interesting info that didn't seem to appear in other threads.


    Process Overview
    1. Revert the phone to an old/vulnerable stock Nougat ROM for Videotron/Freedom Mobile
    2. Enable Dev Options
    3. Dump contents of US996 KDZ partitions over top of existing partitions
    4. Cleanup by re-flashing US996 KDZ partitions over top of existing partitions
    5. Transfer files to the SDCard and install Terminal Emulator
    6. Unlock the Bootloader using the DirtySanta exploit
    7. Boot to old TWRP and install new TWRP
    8. Boot to new TWRP, install LineageOS, Google Apps, and flash modem partition image
    9. Reboot to LineageOS

    Actual Process

    1 - Revert the phone to an old/vulnerable stock Nougat ROM for Videotron/Freedom Mobile
    We need to be on Nougat for this to work, so if you're on Oreo you have to downgrade to Nougat before we begin. I chose a Nougat ROM for the H915 that's vulnerable to the DirtySanta exploit because I know it works and because I'm hoping in the future to be able to skip converting the phone to a US996 if possible.
    • Boot phone into Download Mode
    • Launch LGUP with Patch
    • Select "Upgrade" radio button
    • Select bin file : H91510e_00_VTR_CA_OP_1205.kdz
    • Click Start
    • When finished phone will reboot

    1.5 - Do this if Step 1 Failed... Otherwise continue to Step 2
    Depending on what's loaded on your phone when you start, it might complain about doing Step 1. This should allow us to bypass the issue and allow Step 1 to work. You can use this step if you've already converted the phone to another model as long as it's not bricked.
    • Boot phone into download mode
    • Launch LGIP with Patch
    • Select "PartitionDL" radio button
    • Select bin file : H91510e_00_VTR_CA_OP_1205.kdz
    • Click Start
    • Click the "Select All" partitions checkbox and click OK. When done it will reboot.
    • If it hangs or loops on reboot, boot into "Recovery Mode" (which at this point will Factory Reset the OS)
    • The phone boots into the OS
    • Quickly go through setup wizard. Skip as many things as possible.
    • Go Settings - General - About Phone - Software Info - Make sure it identifies as H91510e
    • Change the USB Option mode to "File Transfer"
    • Then repeat Step 1, but from inside the OS instead of in Download Mode

    2 - Enable Dev Options and File Transfer Mode
    We need these enabled after every time we flash the OS so that our LGUP and adb commands will work. You'll get used to doing these steps a bunch.
    • Quickly go through setup wizard. Skip as many things as possible.
    • Unplug USB-C cable
    • Swipe down from the top and change from USB Charging mode to File Transfer mode
    • Settings - General - About Phone - Software Info
    • Tap on Build Number many times until it unlocks Developer Mode
    • Go back 2 menus and enter the new "Developer Options" menus
    • Make sure "Enable OEM Unlock" is enabled
    • Enable "USB Debugging" (will be greyed out if USB-C cable is still attached)
    • Go back to main screen
    • Plug USB-C cable back in.
    • A pop-up will appear asking to Allow USB Debugging. Check the "Always Allow" box and tap OK

    3 - Dump contents of US996 KDZ partitions over top of existing partition
    The Videotron/Freedom KDZ has no Bootloader/Fastboot mode. If you try to enter bootloader mode you'll just end up charging the battery. So we have to cross-flash the US996 KDZ to get a phone with a bootloader which we can then replace with the engineering version using the DirtySanta exploit.
    • Boot phone into download mode
    • Launch LGUP with Patch
    • Select "PartitionDL" radio button
    • Select bin file : US99610f_00_1205.kdz
    • Click Start
    • Click the "Select All" partitions checkbox and click OK
    • When the phone boots back into the OS, repeat all of Step 2.
      • Note: If it asks for a password on startup, follow the "Boot to Recovery" steps and since
        we don't have anything loaded in the recovery partition it will wipe/erase the phone
        and remove the password.

    4 - Cleanup by re-flashing US996 KDZ partitions over top of existing partitions
    As mentioned in the "Note about flashing KDZ files using LGUP" section above, after you use the PartitionDL method you get a kind of dirty phone image that doesn't always identify as its new model. To clean up, we repeat the process in Upgrade Mode, taking advantage of the fact that at least the OS now identifies as US996 even if Download Mode doesn't. After this, Download Mode will also identify as US996.
    • Starting booted into the OS with a USB-C cable attached (File Transfer mode, USB Debugging on):
    • Launch LGUP with Patch
    • Select "Upgrade" radio button
    • Select bin file : US99610f_00_1205.kdz
    • Click Start
    • When the phone boots back into the OS, repeat all of Step 2.

    5 - Transfer files to the SDCard and install Terminal Emulator
    We will need some files on the SDCard in the phone in order to install them, either inside the OS (in the case of Terminal Emulator), or later on from TWRP. The Terminal Emulator will be used for the DirtySanta exploit so we need to get that installed now.
    • Make sure the USB Connection is set to Data Transfer mode and copy the following files to the SDCard:
      • APK for Terminal Emulator
      • twrp-3.5.1_9-0-us996.img
      • h915freedommobilemodem.img
    • Enable installing apps from unknown sources by:
      • Settings - General - Fingerprints and Security - Unknown sources (turn it On)
    • Install Terminal Emulator:
      • Tools - File Manager
      • Choose "Allow" when prompted
      • Click the up-arrow next to "Internal Storage"
      • Choose SD Card
      • Scroll down and tap on jackpal.androidterm-1.0.70-71-minAPI4.apk
      • Install

    6 - Unlock the Bootloader using the DirtySanta exploit
    The US996 KDZ has a bootloader but it's locked. In order to unlock it we need to use the DirtySanta exploit to give us permissions to replace the Bootloader/Fastboot with a leaked engineering version.

    • Starting booted into the OS with a USB-C cable attached (File Transfer mode, USB Debugging on):
    • Settings - General - About Phone - Software Info
    • Verify that Software Version lists as US99610f
    • Copy the twrp-3.0.2-1-us996.img file into the folder containing the LG V20 Root Package
    • Open a command prompt window and change to the folder containing the LG V20 Root Package and run "Step1.bat"
      • It will push multiple files to the phone and apply some patches/exploits.
      • This proces will take 5 minutes and put you out at an "elsa:/ $" prompt
    • At this "elsa:/ $" prompt in your command prompt window type the following:
    run-as con chmod 0777 /storage/emulated/0/*
    • On the phone, launch Terminal Emulator and run the following:
    id

    • Verify that the string which comes back contains the string "context-u:r:untrusted_app".
      • If not, run Step1.bat again, else continue forward
    • Enter the follosing command into Terminal Emulator (be very careful to type it properly):
    applypatch /system/bin/atd /storage/emulated/0/dirtysanta

    • If that command came back with an error, close and re-open Terminal Emulator and try again
    • The command should begin to patch another file. This will take 5 minutes and will return you to the "elsa:/ $" prompt in Terminal Emulator when it has finished
    • Open another command prompt to the same folder and run "Step2.bat"
      • This step will download backup copies of the boot and aboot partitions from the phone then boot the phone into bootloader/fastboot mode.
      • You'll know it worked if the first line at the top of the phone screen appears in red
    • In the command prompt window, run Step3.bat
      • It will flash boot1.img and the TWRP Recovery image multiple times then restart the phone
    • The phone will hang, no matter how long it's left. Wait 5 minutes (at least until the logo re-loads once) then do the following:
      • Unplug the USB-C cable
      • Remove the battery from the phone to turn it off
      • Replace the battery
      • Boot into Fastboot mode and run the following commands in your command prompt:
    fastboot flash boot bootbackup.img

    • Remove the USB-C cable and battery to turn off the phone. Then replace the battery and enter Recovery Mode
      • The phone will show a big red exclamation mark saying "Your device is corrupt". This is normal. It will go away after a few seconds then boot into recovery. This error screen is the result of the engineering "aboot" image that was flashed to give us an unlocked bootloader and will always happen on boot.
    7 - Boot to old TWRP and install new TWRP
    The old version of TWRP recovery will load. Don't ask me why we can't just go straight to new TWRP above, it didn't work well when I tried it.
    • If it asks for a password to decrypt data, click Cancel
    • Swipe to allow modifications
    • Install - Select Storage - MicroSD Card - OK
    • Install Image - Scroll down and tap the "twrp-3.5.1_9-0-us996.img"
    • Select the Recovery partition and swipe to confirm flash
    • Back to main menu
    • Reboot - Recovery

    8 - Boot to new TWRP, install LineageOS, Google Apps, and flash modem partition image
    The new version of TWRP will load:
    • Check the "Never show this screen during boot again" box
    • Swipe to allow modifications
    • Wipe - Format Data - type "yes" to continue
    • This is likely to fail the first time. Repeat it to properly format the data partition.
    • Go back to Main Menu - Wipe - Advanced Wipe - Select "Dalvik / ART Cache", "System", and "Cache"
    • Swipe to wipe
    • Back to main menu
    • Advanced - ADB Sideload
    • Plug in USB-C cable
    • Swipe to start sideload
    • In command prompt window on PC type the following:
    adb sideload lineage-18.1-20210506-nightly-h910-signed.zip
    • When complete tap "back" and "ADB Sideload" and swipe again to apply another file:
    adb sideload MindTheGapps-11.0.0-arm64-20210412_124247.zip
    • If you want to root the phone (completely optional, not necessary for this process), now is the time to do it. Tap "back" and "ADB Sideload" and swipe again to apply another file:
    adb sideload Magisk-v23.zip
    • Go back to main menu - Install - Install Image - tap the h915freedommobilemodem.img file
    • Select the Modem partition and swipe to confirm flash
    • Remove USB-C cable

    9. Reboot to LineageOS
    • Go back to main menu - Reboot - System - Swipe to reboot


    References where I got the info to make this tutorial