LG velvet Retail Mode Thread

Search This thread

openbox909

Member
Oct 9, 2021
11
0
LG G Pad 10.1
LG G6
Guys, has stucked with new problem. CTS profile, by safety net test is failed. Google pay is wasnt to work. Anyone knew way to fix it?
1) try flash rom its work on my velvet demo(chip erase mode). i tried many rom and only this one has Field test on HIDDEN MENU .
G900UM10d_00_OPEN_CA_OP_0730.kdz Read more at: https://lg-firmwares.com/ru/downloads-file/23822/G900UM10d_00_OPEN_CA_OP_0730
2) Set up all and fix finger scan than INSTALL google pay and last can update to 11 android with LGUP UPDATE MODE
 
Last edited:

openbox909

Member
Oct 9, 2021
11
0
LG G Pad 10.1
LG G6
Also my WiFi doesn’t work after flash WiFi doesn’t come on WiFi stays greyed and modem can’t turn on

flashing a different kdz fixed WiFi but no mobile network works
And radio View attachment 5454457
was same on some rom android 10 just try other rom on chip erase mode fist and second flash rom again on refurbish mode if need record call korean rom is top but for me canadian rom is better because has Field test in Hidden menu
 

Mpanchii

New member
Feb 8, 2022
1
0
I am able to disable retail mode with root junkys guide. Ill post it below. Credit goes to root junky for the disabling retail mode guide. I am currently trying to flash another software KDZ on a retail mode LG Velvet 5G. I run into this error in LGUP. I am using a modified LGup file. has anyone been able to wipe these phones. i saw another xda member claim that the LG wing will flash in LGUP but I cannot figure it out. i tried all options in LGUP. Any IDeas?



click on the retail mode app and put in the password
password 103729
click on factory data reset in the app and put in admin code
Admin L310MC570G
wait for the device to fully factory reset. Once it boots up quickly go into setting about phone and click on the build number 7 times then go into developer options.
open a adb windows on your pc and start adb server with with adb devices.
then toggle usb debugging and click always allow.

disable device admin
adb shell
am start -S com.android.settings/.Settings\$DeviceAdminSettingsActivity
uncheck retail mode admin and deactivate it.
reboot from the shell with reboot.


Uninstall retail mode app
adb shell
pm uninstall -k --user 0 com.lge.retailmode
reboot from the shell with reboot.

Demo mode locks removed

Hope this helps those out there that needed it. The battery will still only charge to 50% but everything else will work as far as i can tell so far.
Rootjunky Out.
Thank you for the great advice !! I have been able to remove the retail mode from my phone but I would like to get access to the play store. I would also like to get rid of the 50% battery barrier. I read about the flash method but I'm it's not so fully comprehensive for me on how to use it. Is there a possibility that you could help me pls ?
lg velvet 5g
android version 10
software version G902V10h
 

RussianGod

Member
Jun 3, 2017
5
1
Hey everyone! Im new here so forgive me for doing anything incorrectly.
I have managed to get Android 12 onto my retail mode LG Velvet 5G.
1) Download the KDZ
Here is the link for the KDZ (link provided by Mr.PvT).

2) Flash with the LGUP 1.16 from this link:
(Provided by 0x0null, just scroll up a bit)

And youre good to go! Everything seems to be working fine on a cursory glance (Minus LG SmartWorld ofc).
I cant test calling, and data, so one if one of you can also get it working, please do detail if 5g or VoLTE or Wifi calling are working for you!

Here are some screenshots:
Screenshots_2022-03-16-17-15-59.png
Screenshots_2022-03-16-17-14-12.png
 

skyblaster

Senior Member
Jan 27, 2009
68
10
Vancouver
I picked up a retail mode Velvet 5G with only a CSN number listed on the sticker (no IMEI).
Model: LM-G901V
Software: G901V10d

I made a backup using the bkerler/edl script. Here's a (slightly edited) excerpt of more model info from the lun0/els partition:
Code:
[    0.501977] 7636 -  suffix : LMG901V.7USAAY, suffix_length : 14
[    0.502371] 7645 -  lge_one_binary_read_hwinfo : base = LM-G900V, current = LM-G901V
[    0.502472] 7645 -  lge_one_binary_update_model_name : FTM postfix_replace_by_offset:LM-G901V
[    0.502538] 7645 -  lge_one_binary_update_model_factory : FTM factoryfix_replace_by_offset:LM-G901V
[    0.502969] 7647 -  lge_one_binary_init : Model Name = LM-G900V -> LM-G901V
[    0.503017] 7647 -  lge_one_binary_needed_model_factory LM-G901V, LM-G901V
[    0.503325] 7650 -  bootmode_set_model_name:  put lg_model_name LM-G901V to smem
[    0.505359] 8014 -  bootcmd: androidboot.vendor.lge.model.name=LM-G901V
[    0.505460] 8014 -  bootcmd: androidboot.vendor.lge.product.model=LM-G900V
[    0.332987] ro.product.system.model=LM-G900V
[    0.333034] ro.product.product.model=LM-G900V
[    0.334238] ro.product.model=LM-G900V
[    0.335022] ro.product.odm.model=LM-G900V
[    0.335078] ro.product.vendor.model=LM-G900V
[    0.336831] ro.boot.serialno=LMG901Vxxxxxxxx #obfuscated
[    0.336842] ro.serialno=LMG901Vxxxxxxxx      #obfuscated
[    0.337740] ro.boot.vendor.lge.model.name=LM-G901V
[    0.337778] ro.vendor.lge.factoryversion=LMG900VAT-00-V10d-LAO-LDU-JUN-23-2020+0

Could this be a Verizon variant?
I'm looking for help on how to cross flash this with the most recent OPEN_CA image for G900UM, or if that won't work, whatever is most appropriate. Thanks!
 

openbox909

Member
Oct 9, 2021
11
0
LG G Pad 10.1
LG G6
I picked up a retail mode Velvet 5G with only a CSN number listed on the sticker (no IMEI).
Model: LM-G901V
Software: G901V10d

I made a backup using the bkerler/edl script. Here's a (slightly edited) excerpt of more model info from the lun0/els partition:
Code:
[    0.501977] 7636 -  suffix : LMG901V.7USAAY, suffix_length : 14
[    0.502371] 7645 -  lge_one_binary_read_hwinfo : base = LM-G900V, current = LM-G901V
[    0.502472] 7645 -  lge_one_binary_update_model_name : FTM postfix_replace_by_offset:LM-G901V
[    0.502538] 7645 -  lge_one_binary_update_model_factory : FTM factoryfix_replace_by_offset:LM-G901V
[    0.502969] 7647 -  lge_one_binary_init : Model Name = LM-G900V -> LM-G901V
[    0.503017] 7647 -  lge_one_binary_needed_model_factory LM-G901V, LM-G901V
[    0.503325] 7650 -  bootmode_set_model_name:  put lg_model_name LM-G901V to smem
[    0.505359] 8014 -  bootcmd: androidboot.vendor.lge.model.name=LM-G901V
[    0.505460] 8014 -  bootcmd: androidboot.vendor.lge.product.model=LM-G900V
[    0.332987] ro.product.system.model=LM-G900V
[    0.333034] ro.product.product.model=LM-G900V
[    0.334238] ro.product.model=LM-G900V
[    0.335022] ro.product.odm.model=LM-G900V
[    0.335078] ro.product.vendor.model=LM-G900V
[    0.336831] ro.boot.serialno=LMG901Vxxxxxxxx #obfuscated
[    0.336842] ro.serialno=LMG901Vxxxxxxxx      #obfuscated
[    0.337740] ro.boot.vendor.lge.model.name=LM-G901V
[    0.337778] ro.vendor.lge.factoryversion=LMG900VAT-00-V10d-LAO-LDU-JUN-23-2020+0

Could this be a Verizon variant?
I'm looking for help on how to cross flash this with the most recent OPEN_CA image for G900UM, or if that won't work, whatever is most appropriate. Thanks!
I have the same one it was ATT retal mode variant( battery 4300mA and lens of camera not same WRZ) but can flash it for Canadian ROM or Korean ROM
 

Attachments

  • IMG-20220428-WA0003.jpg
    IMG-20220428-WA0003.jpg
    60.1 KB · Views: 12

skyblaster

Senior Member
Jan 27, 2009
68
10
Vancouver
Has anyone ever succeeded in either of the following with one of these demo units:

1) Getting an IMEI to be autogenerated?
My original fsc and fsg partitions read back empty, so I'm guessing the answer is no.

2) Getting an OTA update?


EDIT: Also, I'm interested in an ftm partition from a non-demo LM-G900UM2, if anyone would care to share. Thanks!
 
Last edited:

Wish39

Senior Member
Jan 13, 2015
196
48
I picked up a retail mode Velvet 5G with only a CSN number listed on the sticker (no IMEI).
Model: LM-G901V
Software: G901V10d

I made a backup using the bkerler/edl script. Here's a (slightly edited) excerpt of more model info from the lun0/els partition:
Code:
[    0.501977] 7636 -  suffix : LMG901V.7USAAY, suffix_length : 14
[    0.502371] 7645 -  lge_one_binary_read_hwinfo : base = LM-G900V, current = LM-G901V
[    0.502472] 7645 -  lge_one_binary_update_model_name : FTM postfix_replace_by_offset:LM-G901V
[    0.502538] 7645 -  lge_one_binary_update_model_factory : FTM factoryfix_replace_by_offset:LM-G901V
[    0.502969] 7647 -  lge_one_binary_init : Model Name = LM-G900V -> LM-G901V
[    0.503017] 7647 -  lge_one_binary_needed_model_factory LM-G901V, LM-G901V
[    0.503325] 7650 -  bootmode_set_model_name:  put lg_model_name LM-G901V to smem
[    0.505359] 8014 -  bootcmd: androidboot.vendor.lge.model.name=LM-G901V
[    0.505460] 8014 -  bootcmd: androidboot.vendor.lge.product.model=LM-G900V
[    0.332987] ro.product.system.model=LM-G900V
[    0.333034] ro.product.product.model=LM-G900V
[    0.334238] ro.product.model=LM-G900V
[    0.335022] ro.product.odm.model=LM-G900V
[    0.335078] ro.product.vendor.model=LM-G900V
[    0.336831] ro.boot.serialno=LMG901Vxxxxxxxx #obfuscated
[    0.336842] ro.serialno=LMG901Vxxxxxxxx      #obfuscated
[    0.337740] ro.boot.vendor.lge.model.name=LM-G901V
[    0.337778] ro.vendor.lge.factoryversion=LMG900VAT-00-V10d-LAO-LDU-JUN-23-2020+0

Could this be a Verizon variant?
I'm looking for help on how to cross flash this with the most recent OPEN_CA image for G900UM, or if that won't work, whatever is most appropriate. Thanks!
How did you dump the firmware using the EDL script?
 

Wish39

Senior Member
Jan 13, 2015
196
48
Has anyone ever succeeded in either of the following with one of these demo units:

1) Getting an IMEI to be autogenerated?
My original fsc and fsg partitions read back empty, so I'm guessing the answer is no.

2) Getting an OTA update?


EDIT: Also, I'm interested in an ftm partition from a non-demo LM-G900UM2, if anyone would care to share. Thanks!
If I can make a dump of my AT&T G900UM, I can give you the ftm partition
 

skyblaster

Senior Member
Jan 27, 2009
68
10
Vancouver
How did you dump the firmware using the EDL script?

This will backup everything into separate LUN directories.:
Code:
./edl rl /media/user/path/LG_Velvet --memory=ufs --genxml --loader=/opt/edl/Loaders/qualcomm/factory/sd765/0000000000720000_1bebe3863a6781db_fhprg.bin

If I can make a dump of my AT&T G900UM, I can give you the ftm partition
Thanks!

For just the ftm:
Code:
./edl r ftm ftm.bin --memory=ufs --lun=0 --loader=/opt/edl/Loaders/qualcomm/factory/sd765/0000000000720000_1bebe3863a6781db_fhprg.bin
 

Wish39

Senior Member
Jan 13, 2015
196
48
This will backup everything into separate LUN directories.:
Code:
./edl rl /media/user/path/LG_Velvet --memory=ufs --genxml --loader=/opt/edl/Loaders/qualcomm/factory/sd765/0000000000720000_1bebe3863a6781db_fhprg.bin


Thanks!

For just the ftm:
Code:
./edl r ftm ftm.bin --memory=ufs --lun=0 --loader=/opt/edl/Loaders/qualcomm/factory/sd765/0000000000720000_1bebe3863a6781db_fhprg.bin
Didn't work :(
What's the output that you get when dumping something from your demo device?
1654495990772.png
 

skyblaster

Senior Member
Jan 27, 2009
68
10
Vancouver
Didn't work :(
What's the output that you get when dumping something from your demo device?

I just tried from Fedora and couldn't even load edl, so resorted to the provided LiveDVD. I would recommend using this if you're still having trouble. Check out Ventoy for live distros on USB storage.

The --skip partition feature baked into that iso doesn't work, so you will need to checkout from master if you want to skip the larger paritions.

Anyway, here's what a successful dump looks like.

If you want to give it another try without the live iso, my only other piece of advice would be to queue up the command and execute it immediately after entering 9008 mode. This is especially important for writing. See: https://github.com/bkerler/edl/issues/278

Code:
[email protected]:/opt/edl$ ./edl r ftm ftm.bin --memory=ufs --lun=0 --loader=/opt/edl/Loaders/qualcomm/factory/sd765/0000000000720000_1bebe3863a6781db_fhprg.bin
Qualcomm Sahara / Firehose Client V3.60 (c) B.Kerler 2018-2022.
main - Using loader /opt/edl/Loaders/qualcomm/factory/sd765/0000000000720000_1bebe3863a6781db_fhprg.bin ...
main - Waiting for the device
main - Device detected :)
sahara - Protocol version: 2.1
main - Mode detected: sahara
sahara -
------------------------
HWID:              0x0011e0e100000000 (MSM_ID:0x0011e0e1,OEM_ID:0x0000,MODEL_ID:0x0000)
CPU detected:      "saipan"
PK_HASH:           0xd40eee56f3194665574109a39267724ae7944134cd53cb767e293d3c40497955
Serial:            0xb23bed1c

sahara - Protocol version: 2.1
sahara - Uploading loader /opt/edl/Loaders/qualcomm/factory/sd765/0000000000720000_1bebe3863a6781db_fhprg.bin ...
sahara - 64-Bit mode detected.
sahara - Firehose mode detected, uploading...
sahara - Loader successfully uploaded.
main - Trying to connect to firehose loader ...
firehose - INFO: Binary build date: Mar 26 2020 @ 22:00:48
firehose - INFO: Binary build date: Mar 26 2020 @ 22:00:48
firehose - INFO: Chip serial num: 2990271772 (0xb23bed1c)
firehose - INFO: Supported Functions (15):
firehose - INFO: program
firehose - INFO: read
firehose - INFO: nop
firehose - INFO: patch
firehose - INFO: configure
firehose - INFO: setbootablestoragedrive
firehose - INFO: erase
firehose - INFO: power
firehose - INFO: firmwarewrite
firehose - INFO: getstorageinfo
firehose - INFO: benchmark
firehose - INFO: emmc
firehose - INFO: ufs
firehose - INFO: fixgpt
firehose - INFO: getsha256digest
firehose - INFO: End of supported functions 15
firehose
firehose - [LIB]: Couldn't detect MaxPayloadSizeFromTargetinBytes
firehose
firehose - [LIB]: Couldn't detect TargetName
firehose - TargetName=Unknown
firehose - MemoryName=UFS
firehose - Version=1
firehose - Trying to read first storage sector...
firehose - Running configure...
firehose - Storage report:
firehose - total_blocks:30879744
firehose - block_size:4096
firehose - page_size:4096
firehose - num_physical:7
firehose - manufacturer_id:462
firehose - serial_num:1297306958
firehose - fw_version:100
firehose - mem_type:UFS
firehose - prod_name:KM2V8001CM-B707
firehose_client - Supported functions:
-----------------
program,read,nop,patch,configure,setbootablestoragedrive,erase,power,firmwarewrite,getstorageinfo,benchmark,emmc,ufs,fixgpt,getsha256digest
firehose -
Reading from physical partition 0, sector 75912, sectors 8192
Progress: |██████████████████████████████████████████████████| 100.0% Read (Sector 0x2000 of 0x2000, ) 38.07 MB/s                                               
Dumped sector 75912 with sector count 8192 as ftm.bin.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 2
    How did you get a network signal without imei?

    1 download and install LG flash tool
    2 download DLL file
    3 download and install LG drivers
    4 make sure the phone is charged at least 20%
    5 turn off the phone using these codes
    103729
    L310MC570G
    6 run LG flash tool selects that kdz file https://lg-firmwares.com/lg-lmg900n-firmwares/

    (only Korean software will work )
    select the DLL file and press ok and then starts

    7 hold volume up while the phone is shut down and plug the USB cable
    The phone will go to download mode and start flashing if not go to the device manager choose the port and change the port to port 41

    After finishing flashing you will find the fingerprint is not working go to Google and search LG hidden menu APK download install
    Use code #*462633*#900#

    Go to svc menu -fingerprint - enable
    Then go back to and go to devise test - manual test - handprint test and do it you know it's worked when it says fail
    1
    I am able to disable retail mode with root junkys guide. Ill post it below. Credit goes to root junky for the disabling retail mode guide. I am currently trying to flash another software KDZ on a retail mode LG Velvet 5G. I run into this error in LGUP. I am using a modified LGup file. has anyone been able to wipe these phones. i saw another xda member claim that the LG wing will flash in LGUP but I cannot figure it out. i tried all options in LGUP. Any IDeas?



    click on the retail mode app and put in the password
    password 103729
    click on factory data reset in the app and put in admin code
    Admin L310MC570G
    wait for the device to fully factory reset. Once it boots up quickly go into setting about phone and click on the build number 7 times then go into developer options.
    open a adb windows on your pc and start adb server with with adb devices.
    then toggle usb debugging and click always allow.

    disable device admin
    adb shell
    am start -S com.android.settings/.Settings\$DeviceAdminSettingsActivity
    uncheck retail mode admin and deactivate it.
    reboot from the shell with reboot.


    Uninstall retail mode app
    adb shell
    pm uninstall -k --user 0 com.lge.retailmode
    reboot from the shell with reboot.

    Demo mode locks removed

    Hope this helps those out there that needed it. The battery will still only charge to 50% but everything else will work as far as i can tell so far.
    Rootjunky Out.
    1

    Here is the files I used every thing is working only faceunlock and fingers print not working
    And some times the play store crashedView attachment 5395825
    quick update i mange to fix fingerprint using this fix


    1
    Everything things work except system update and LG smart world and LG backup
    1

    1 download and install LG flash tool
    2 download DLL file
    3 download and install LG drivers
    4 make sure the phone is charged at least 20%
    5 turn off the phone using these codes
    103729
    L310MC570G
    6 run LG flash tool selects that kdz file https://lg-firmwares.com/lg-lmg900n-firmwares/

    (only Korean software will work )
    select the DLL file and press ok and then starts

    7 hold volume up while the phone is shut down and plug the USB cable
    The phone will go to download mode and start flashing if not go to the device manager choose the port and change the port to port 41

    After finishing flashing you will find the fingerprint is not working go to Google and search LG hidden menu APK download install
    Use code #*462633*#900#

    Go to svc menu -fingerprint - enable
    Then go back to and go to devise test - manual test - handprint test and do it you know it's worked when it says fail
    Sorry to bother, but there are 3 different Korean ROMs KTF, LGT and SKT, which one do you recommend downloading?
    And can I download the latest Android 11 and flash that one directly?