Help each other: firehose and eng bootloader publicly available

[haise.zero]

Thank you to everyone for patiently waiting - I know these forums have been dark and getting darker. I really hope that this will help bring some life back into the LG Forums; you guys deserve it.


Sorry about this, guys.

Not long ago, @ps3hacker3 and I got our hands on a firehose programmer for the Kona, and the engineering bootloader for the V60.

I created the post as I was under the assumption that we had a working method to provide the ability to unlock the device and root it. Over time as I looked more and more into it, a prevalent issue arose: Sahara refuses to communicate with us when trying to open the partition manager from QFIL.
The original process used on ps3hacker3's LMV600AM model utilized Medusa Pro, but as far as I can tell, I can't help but feel like I'm still missing a piece of this puzzle. Perhaps it's as simple as a setting configuration, and perhaps it's as complex as an entire other part of this process that I'm missing.
Nonetheless, I can leave you with two things.
A) The firehose, one way or another, despite what anybody says or doubts about it, worked on ps3hacker3's phone. Screenshots as proof are available deeper into the thread.
B) The engineering bootloader worked just as well.

I apologize for thinking that I'd gotten you halfway there, and for prematurely creating a thread that posed answers without being able to follow through on the process. In acknowledgement of the time and amount of workload and stress this project and the Stylo 6 projects have taken up in my life, I don't feel that I have the capacity to continue leading any of these projects anymore.

I would still take everything that anyone in this thread, seemingly right or wrong, said with a grain of salt and do your own research and ask people your own questions before concluding anything. It's nothing personal to do with anybody, it's just the best advice that I can give you based off of the situation. I didn't learn anything by taking everybody's word for it. Even if you're wrong at first, or the first hundred times, just keep doubting and testing theories. Keep wondering. Nobody knows everything and even well-established concepts may not be fully fleshed out, especially in the world of consumers and developers attempting to use software and files from OEMs and other manufacturers that is meant to remain unbeknownst to us. There's a lot I don't know, and a lot everyone doesn't know.

Thank you for being here with me on this journey.
I hope that the files can still make themselves useful - I have full confidence that they do.
Regardless, someone I would feel more comfortable not naming due to a recently closed thread was using them to unlock phones for high prices for people. Skipping over the drama, I just wanted to make them available for everybody. I suppose I've done my part, so please take this into your hands and give it all you've got.
The original post contents are in a dropdown below. I advise you to not blindly follow through with all of it.

It's up to you guys now - do your best.
Stay hopeful, and question everything. All the time.
Haise

Spoiler: Original post contents

NOTE:
Apparently, I overlooked a detail as I didn't think it was necessary. QPST was not used here, but rather a patched Medusa that can be found here.
The way this worked was complicated and I overlooked the fact we do not have a patched Medusa.
QPST is apparently unsuccessful at the moment.
I am working on a fix for this.
If anyone has any success with a specific QFIL or QPST version then please be sure to let us know so that I can update the post.
We have the files - hardest part is over. Now we just have to be able to use them.

Apologies to everybody who ran into troubles.
I am testing on the T-Mobile variant as soon as we're able to.

It's over.




Enter 9008:

• Qualcomm USB 9008 drivers should be installed prior to this operation. These can be retrieved below, inside the archive along with the necessary files.
• Your phone must be plugged into the computer prior to the rest of the process.
• With your phone on, hold volume down and power. After about ten seconds, continue to hold power and volume down, while also spamming volume up. This works much better if your device is powered on and your screen is on, as a bar will show up on the bottom and you can initiate the volume up spamming as soon as the bar drains to empty.
• As soon as the screen turns black, let go of all of the buttons. The device should appear in 9008 mode in the Device Manager.

I'm going to be honest, guys - I've been working on the Stylo 6 since January and the V60 from some random point a few months ago. From here my memory's foggy, I'm tired, and you guys are smart, so if someone needs help, then help each other, okay?

Generally speaking you can use QPST or another piece of software that can interact with Qualcomm devices in 9008 mode the patched Medusa from the link at the top of the post to flash the engineering bootloader. You will use the firehose attached below along with the eng boot for this.
I don't know why it is that Medusa is required. It is unfortunate.

The previous V40 thread is practically identical and has a lot of prior support and questions answered that, the vast majority of the time, can be adapted to the current model and files. They also cover many potential problems that I did not, and it is strongly recommended that you review that thread.


Be kind. Be patient. Be courteous. Share.


And enjoy.
Haise

Special thanks to @ps3hacker3 for participating in my Discord server and working with me last second on managing to obtain the files.
Donate to him and his partner here: PayPal.me

 

[Warlockguitarman]

gonna try it right now since i just unbricked my V60 that i was attempting to unlock the way i did my stylo6's and K51

 

[krissrmx]

Thank you sir
Can we flash the V35 engineering bootloader?? From the other thread you mention???

 

[memnon79]

Any word on getting this to work on T-Mobile variant? V40 notes said it does not work on T-Mobile.

 

[haise.zero]

Thank you sir
Can we flash the V35 engineering bootloader?? From the other thread you mention???

No, just the bootloader within the archive posted here

 

[haise.zero]

Any word on getting this to work on T-Mobile variant? V40 notes said it does not work on T-Mobile.

I'm not sure. I have the TMO and I'll be trying I'm a little while. I'll update the post to let everyone know so be sure to keep an eye on it

 

[haise.zero]

It's my understanding people are having trouble with QPST.
We used a patched Medusa and it seems unfortunately that it was necessary. I'll be updating the post shortly.

 

[memnon79]

I'm not sure. I have the TMO and I'll be trying I'm a little while. I'll update the post to let everyone know so be sure to keep an eye on it

Thanks for all the hard work!

 

[wannan1985]

This is the firehose file of ZTE phone,not support LG phones.
CN = QCT Attestation CA O = QUALCOMM OU = General ztemt attestation L = San Diego S = CA C = US

 

[ebowen 747]

It's my understanding people are having trouble with QPST.
We used a patched Medusa and it seems unfortunately that it was necessary. I'll be updating the post shortly.

Will you repost the Medusa link?

 

[haise.zero]

Will you repost the Medusa link?

There is not Medusa link as of the moment. There was an oversight and I'm looking into this.
QFIL and QPST aren't working either.

Some patience please

 

[haise.zero]

This is the firehose file of ZTE phone,not support LG phones.
CN = QCT Attestation CA O = QUALCOMM OU = General ztemt attestation L = San Diego S = CA C = USView attachment 5347163

Except that it did.
So... say what you will. I genuinely witnessed this file get used. Speculate about the details with someone else. I'm not here to debate. I'm here to provide.

Next time consider asking some questions instead of pointing a finger and implying that I'm wrong because of some information you have without actually elaborating.
I wouldn't be here if it didn't actually work.

<3

EDIT:
Hey, also, your port 8888 is open, and thus so is your site login.
Also, your site is really broken.
Best of luck

 

[wannan1985]

For devices that have replaced the CPU, the firehose signature is not verified. You can view it through *#546368#*model#-SVC Menu-MID Info-IMPL
Thank you very much for your reminder, my website is no longer operating.

 

[haise.zero]

For devices that have replaced the CPU, the firehose signature is not verified. You can view it through *#546368#*model#-SVC Menu-MID Info-IMPL
Thank you very much for your reminder, my website is no longer operating.

This further solidifies my theory, luckily enough. It doesn't pass attestation, but it does function correctly.
So... that's it.
Working on getting the firehose to work tonight. I do know that it does indeed function because we have someone who has an unlocked bootloader because of it.
It may not officially support the V60 due to it being designed for ZTE, but it does functionally support it. Perhaps it's because this is the Kona processor, which is the prototype version of the processor. Either way, it functionally supports it, and the obstacle of getting around attestation is much less daunting to me than not having the files we need or knowing how to unlock the device.

 

[Moto G.]

Except that it did.
So... say what you will. I genuinely witnessed this file get used. Speculate about the details with someone else. I'm not here to debate. I'm here to provide.

Next time consider asking some questions instead of pointing a finger and implying that I'm wrong because of some information you have without actually elaborating.
I wouldn't be here if it didn't actually work.

<3

EDIT:
Hey, also, your port 8888 is open, and thus so is your site login.
Also, your site is really broken.
Best of luck

Bro, this is a fake, the original firehose has a different hash, this one is not from LG.

His phone will not accept, neither through jellyfish, nor through QFIL, you can not tr

It is very important that the hash matches what is required.y.d.y.

 

[maxpatri9]

Thank you to everyone for patiently waiting - I know these forums have been dark and getting darker. I really hope that this will help bring some life back into the LG Forums; you guys deserve it.


NOTE:
Apparently, I overlooked a detail as I didn't think it was necessary. QPST was not used here, but rather a patched Medusa that can be found here.
The way this worked was complicated and I overlooked the fact we do not have a patched Medusa.
QPST is apparently unsuccessful at the moment.
I am working on a fix for this.
If anyone has any success with a specific QFIL or QPST version then please be sure to let us know so that I can update the post.
We have the files - hardest part is over. Now we just have to be able to use them.

Apologies to everybody who ran into troubles.
I am testing on the T-Mobile variant as soon as we're able to.

It's over.




Enter 9008:

• Qualcomm USB 9008 drivers should be installed prior to this operation. These can be retrieved below, inside the archive along with the necessary files.
• Your phone must be plugged into the computer prior to the rest of the process.
• With your phone on, hold volume down and power. After about ten seconds, continue to hold power and volume down, while also spamming volume up. This works much better if your device is powered on and your screen is on, as a bar will show up on the bottom and you can initiate the volume up spamming as soon as the bar drains to empty.
• As soon as the screen turns black, let go of all of the buttons. The device should appear in 9008 mode in the Device Manager.

I'm going to be honest, guys - I've been working on the Stylo 6 since January and the V60 from some random point a few months ago. From here my memory's foggy, I'm tired, and you guys are smart, so if someone needs help, then help each other, okay?

Generally speaking you can use QPST or another piece of software that can interact with Qualcomm devices in 9008 mode the patched Medusa from the link at the top of the post to flash the engineering bootloader. You will use the firehose attached below along with the eng boot for this.
I don't know why it is that Medusa is required. It is unfortunate.

The previous V40 thread is practically identical and has a lot of prior support and questions answered that, the vast majority of the time, can be adapted to the current model and files. They also cover many potential problems that I did not, and it is strongly recommended that you review that thread.


Be kind. Be patient. Be courteous. Share.


And enjoy.
Haise






Special thanks to @ps3hacker3 for participating in my Discord server and working with me last second on managing to obtain the files.
Donate to him and his partner here: PayPal.me

i have verizon variant
Operation : Read Information
Checking for existing devices...Not Found
Turn Off phone, hold Vol UP + Vol DOWN and insert USB cable.
Some phones may need Special Boot Cable or TestPoint for EDL mode.
Found Port : Qualcomm HS-USB QDLoader 9008 (COM4)
Driver Info : Network Connect, qcusbser.sys, 3.0.0.0
Connecting to phone...OK
Waiting for response...OK
Init Handshake Sequence...OK
Hardware ID : E1300C00 [SD8250] 00003100
OPK_DATA : B7CD248E4DC4A3CAF07E12F2E1F331E3176FCF864871446CD204625C74D9F94A
Initializing Protocol...OK
Sending Loader [prog_ufs_firehose_sdm8250_ddr.elf]...Error
Please use correct loader and check USB port / cable.
Operation Finished.
QcFire Ver. 6.8

 

[maxpatri9]

This further solidifies my theory, luckily enough. It doesn't pass attestation, but it does function correctly.
So... that's it.
Working on getting the firehose to work tonight. I do know that it does indeed function because we have someone who has an unlocked bootloader because of it.
It may not officially support the V60 due to it being designed for ZTE, but it does functionally support it. Perhaps it's because this is the Kona processor, which is the prototype version of the processor. Either way, it functionally supports it, and the obstacle of getting around attestation is much less daunting to me than not having the files we need or knowing how to unlock the device.

i have a lg v60 verizon variant frp locked

 

[ps3hacker3]

Bro, this is a fake, the original firehose has a different hash, this one is not from LG.

His phone will not accept, neither through jellyfish, nor through QFIL, you can not tr

It is very important that the hash matches what is required.y.d.y.

Seriously we are going down this road of nonsense^?

Ok my turn, listen up. The guy he is refering to that he has seen this firehose and ENG boot work on a V60 (AT&T model) is me, I was let known that numerous people were grabbing their pitchforks and calling this fake.

Im no DEV on android or any of the sort, Im just a guy that paid some other dude 20 bucks to root my phone but on the side of things without him knowing I hijacked all the files that he used to root my phone and then proceeded to send @haise.zero here everything that I acquired and every detail I could remember while I was on the phone with him through the process to see if I can get exactly the two files posted above from him.

I have no idea why or how that firehose above works, Thats not my part in this. I dont know, they only I can say is STOP SAYING THIS IS FAKE!! Sit down and listen, this is not fake. This is not some childish scam, This is real. Im literally HOLDING the phone that is rooted/unlocked. IT WORKS, Period. Trying to counter argue that when im holding the phone it was done to and watched right in front of my eyes on my personal computer (With this mysterious cracked medusa software via an octoplus box) makes you look foolish.

You want more proof, You hit me up on discord. Ill voice call you and send you anything and everything you need or want to see for your own eyes. Ill be here waiting for more counter arguments.

 

[haise.zero]

Hash validity is important, and I understand that QFIL doesn't like it.
On the other hand, its functionality does work. As seen above, and as witnessed by myself, it does work.

The signature was not for LG, it was for ZTE. Qualcomm's signature for the other company is not to be completely ignored.
The ZTE firehose, if attestation can be worked around, is full and well capable of flashing our device's bootloader.

Medusa Pro was used by the original person. This is our present issue. We are working on it and the original XDA post will be expanded as soon as we have this working.
I appreciate the concern, but instilling fear in people that this is guaranteed to brick their device or that it's completely unsupported is really not helpful whatsoever.

Thank you.

 

[maxpatri9]

Seriously we are going down this road of nonsense^?

Ok my turn, listen up. The guy he is refering to that he has seen this firehose and ENG boot work on a V60 (AT&T model) is me, I was let known that numerous people were grabbing their pitchforks and calling this fake.

Im no DEV on android or any of the sort, Im just a guy that paid some other dude 20 bucks to root my phone but on the side of things without him knowing I hijacked all the files that he used to root my phone and then proceeded to send @haise.zero here everything that I acquired and every detail I could remember while I was on the phone with him through the process to see if I can get exactly the two files posted above from him.

I have no idea why or how that firehose above works, Thats not my part in this. I dont know, they only I can say is STOP SAYING THIS IS FAKE!! Sit down and listen, this is not fake. This is not some childish scam, This is real. Im literally HOLDING the phone that is rooted/unlocked. IT WORKS, Period. Trying to counter argue that when im holding the phone it was done to and watched right in front of my eyes on my personal computer (With this mysterious cracked medusa software via an octoplus box) makes you look foolish.

You want more proof, You hit me up on discord. Ill voice call you and send you anything and everything you need or want to see for your own eyes. Ill be here waiting for more counter arguments.

i need for frp lg v60 verizon model i test a lot od trick nothing work