• XDA Forums have been migrated to XenForo. We are aware of several issues including missing threads, logins not working, and more. To discuss, use this thread.
  • If you are experiencing issues logging in, we migrated and software and made it more secure. We recommend trying to reset your password.

[REQ] Need help. Unbrick phones with locked bootloader, oem unlock disabled

bitdomo

New member
Nov 3, 2011
1,542
1,240
0
28
Göd
I have made some success with the help of @gee one providing me the necessary files needed for making tot file for both H790 and H791 32GB varaint Nexus 5X.
It was tested on @JaCh0o's bricked H791 32GB Nexus 5X
I am still waiting for somebody with a 16GB Nexus 5X to make me a dump of the Primary GPT (first 512 kb of the emmc) and the Backup GPT (last 512 kb of the emmc) to make tot file for the 16GB Nexus 5X too.
If sombody is in this situation please follow the guide.


  • Download TOT file for your device
  • Download LG usb drivers
  • Download LGUP tool
  • Download 8994 dll for LGUP
  • Install LG usb drivers
  • Install LGUP tool
  • Install 8994 dll for LGUP
  • Turn off your phone
  • Press and hold the volume_up key while you connect the phone to the PC with usb cable.
  • Wait for Windows to install the new drivers
  • Start LGUP

  • Either select refurbish (will wipe userdata) or upgrade (wont wipe userdata)

  • Click on the line where it says BIN file to make the button with "..." appear and click on it then select the tot file.


  • Click on start
This here is not important
I have a solution in my head for those who have locked their bootloader and disabled oem unlocking with a modified system and now they are stucked in bricked condition with their phones
To make this idea to a real solution I need some help from you guys as I dont have nexus 5x. My idea is enter to LG's download and flash a tot file for nexus 5x using lg flashtool. Since there are no leaked tot files for nexus 5x yet, so I will do one. I have dll file which will probably work for nexus 5x (90%).

First of all before I jump in head first to making a tot file, please let me know are you able to boot your nexus 5x to LG's download.
According to my sources to enter download mode you have to turn off your phone then plug the usb cable to the phone wile you keep pressing the volume_up key. If this key combination gets you into LG's download then it is great. To exit from LG's download just keep pressing the power key and the phone will shutdown. If it does not work then it is still possible to enter download mode but with using LG's 910kOhm usb cable.

The next things I need are dump files of Primary_GPT (first 512 kb of the emmc), misc partition (to see LG's version numbering for nexus 5X, it is important for tot files), laf partition and Backup_GPT (last 512 kb of the emmc). For GPTs I will need both the 32 gb and the 16 gb variants of the phone.
 
Last edited:

gee one

New member
Jul 29, 2010
1,979
865
0
linux command line
Download mode does work with volume up. I'm not sure about the USB cable, but I did get into download mode several times while trying to "fix" my phone.

Think I have the other files for the 32gb variant as well, but I'm traveling right now.
 

JaCh0o

New member
Aug 16, 2011
134
9
0
Great! We are one step ahead. Thanks.
Also can confirm that phone is loading Download Mode.
I have locked oem after turning on OEM control in Developer Mode, then wiped by TWRP whole availible partitions and flashed stock recovery on it. Now got "clean" phone with no way to get working.
Here's my thread about that issue:
http://forum.xda-developers.com/nexus-5x/help/how-to-enable-oem-unlocking-bricked-t3249003/page2
What aprox time we gonna wait for stock tot files ?? I'm thinking about shipping phone to LG Service (would prefer to do it by myself) It's not my phone and the preson is pressing on me about that. Will your tot files makes phone tamper flag on? Is it possible to set in off back again ?
 

bitdomo

New member
Nov 3, 2011
1,542
1,240
0
28
Göd
Also can confirm that phone is loading Download Mode.
I have locked oem after turning on OEM control in Developer Mode, then wiped by TWRP whole availible partitions and flashed stock recovery on it. Now got "clean" phone with no way to get working.
Here's my thread about that issue:
http://forum.xda-developers.com/nexus-5x/help/how-to-enable-oem-unlocking-bricked-t3249003/page2
What aprox time we gonna wait for stock tot files ?? I'm thinking about shipping phone to LG Service (would prefer to do it by myself) It's not my phone and the preson is pressing on me about that. Will your tot files makes phone tamper flag on? Is it possible to set in off back again ?
I am done with the tot file for the 32gb variant, thanks to @gee one
I am still waiting for the 16 gb variant's primary gpt and backup gpt dump.
If you have the 32 gb variant we can give a try.

Lg flashtool never sets tamper flag on. For nexus 5 it locks the bootloader and resets the tamper flag.
 
  • Like
Reactions: JaCh0o

JaCh0o

New member
Aug 16, 2011
134
9
0
I am done with the tot file for the 32gb variant, thanks to @gee one
I am still waiting for the 16 gb variant's primary gpt and backup gpt dump.
If you have the 32 gb variant we can give a try.

Lg flashtool never sets tamper flag on. For nexus 5 it locks the bootloader and resets the tamper flag.
Yes, I got 32gb version. Can I ask you for short instructions how to flash it properly and links to 32gb version files?

Wysłane z mojego Oppo Find 7 przy użyciu Taptalka
 

bitdomo

New member
Nov 3, 2011
1,542
1,240
0
28
Göd
Yes, I got 32gb version. Can I ask you for short instructions how to flash it properly and links to 32gb version files?

Wysłane z mojego Oppo Find 7 przy użyciu Taptalka
Download usb drivers
Download LG flashtool
Download dll file
Download H790 or H791 tot file for 32GB variant
Follow the steps in this video. I made this video for nexus 5, but everything is the same for nexus 5x too. Just use the the tot and the dll file I linked.
If you have the H791 variant can you check the device factory version? If you flashed the tot successfully you should see a LOG folder in the same directory as the dll file. You will find a .txt file in the LOG directory. Search for device factory version and paste it here. It is something like this: LGH790AT-00-V10f-NXS-XXX-OCT-03-2015-32G-MDA89E-US
 
  • Like
Reactions: efrant and JaCh0o

JaCh0o

New member
Aug 16, 2011
134
9
0
Download usb drivers
Download LG flashtool
Download dll file
Download H790 or H791 tot file for 32GB variant
Follow the steps in this video. I made this video for nexus 5, but everything is the same for nexus 5x too. Just use the the tot and the dll file I linked.
If you have the H791 variant can you check the device factory version? If you flashed the tot successfully you should see a LOG folder in the same directory as the dll file. You will find a .txt file in the LOG directory. Search for device factory version and paste it here. It is something like this: LGH790AT-00-V10f-NXS-XXX-OCT-03-2015-32G-MDA89E-US
As I can see this example is for US. Im from Poland (Central Europe). There will be no problem with radio/modem brandwitdth ? Is this for every H791 32GB Nexus 5x ? This dll file looks to be for LG G4, is it ok ?
 
Last edited:

bitdomo

New member
Nov 3, 2011
1,542
1,240
0
28
Göd
As I can see this example is for US. Im from Poland (Central Europe). There will be no problem with radio/modem brandwitdth ? Is this for every H791 32GB Nexus 5x ? This dll file looks to be for LG G4, is it ok ?
Same modem is used for both nexus 5x, and for the dll it should not be a problem. LG Optimus G dll can be used for all LG optimus G and nexus 4, LG G2 dll can be used for all LG G2, G3 and nexus 5. And I think that "US" at the end of file name is a short form of USER and not united states, but I cannot tell for sure until you post the device factory version of a H971.

Edit: The only differance between the two tot file is the model string and tot version string.

For H790 the model string is LGH790 and the tot version string is LGH790AT-00-V10f-NXS-XXX-OCT-03-2015-32G-MDA89E-US

For H791 the model string is LGH791 and the tot version string is LGH791AT-00-V10f-NXS-XXX-OCT-03-2015-32G-MDA89E-US

These two strings makes no differnace it could be anything, but sadly lg flashtool will throw an error like model mismatch H790 => H791 if you try to flash a H791 tot file to a H790, so this is the only reasone why we need seperate tot files. And also the most recently flashed tot file's version number will be written to the misc partition so that is why I ask for the device factory version to dont screw up the versioning. But all these has no effect on the phone's behaviour.
 
Last edited:

JaCh0o

New member
Aug 16, 2011
134
9
0
Same modem is used for both nexus 5x, and for the dll it should not be a problem. LG Optimus G dll can be used for all LG optimus G and nexus 4, LG G2 dll can be used for all LG G2, G3 and nexus 5. And I think that "US" at the end of file name is a short form of USER and not united states, but I cannot tell for sure until you post the device factory version of a H971.
Here's log. FAILED DoDownload Error! After 16 sec and 9%
This phone is after cleaning with TWRP Wipe All. It is Nexus 5X H791 32GB Euro (with last soft MRB08L).
By Device Factory Version you mean H791 or H790 yes ?? If so this is H791 for sure.

The question about radio and my concern about it is made by some notes:
https://productforums.google.com/forum/#!topic/nexus/ku-FFtRjf-o
https://www.reddit.com/r/Nexus5/comments/28d3vt/european_nexus_5_in_the_usa_will_4g_work/

Any solution to flash successfully ?
 

Attachments

Last edited:

bitdomo

New member
Nov 3, 2011
1,542
1,240
0
28
Göd
Here's log. FAILED DoDownload Error! After 16 sec and 9%
This phone is after cleaning with TWRP Wipe All. It is Nexus 5X H791 32GB Euro (with last soft MRB08L).
By Device Factory Version you mean H791 or H790 yes ?? If so this is H791 for sure.

The question about radio and my concern about it is made by some notes:
https://productforums.google.com/forum/#!topic/nexus/ku-FFtRjf-o
https://www.reddit.com/r/Nexus5/comments/28d3vt/european_nexus_5_in_the_usa_will_4g_work/

Any solution to flash successfully ?
Thanks for the feedback. The error is this

[01:01:531] Invalid Tot File : Invalid Partition Size(57973760)
Probably it is because of the 3gb system.img I try to flash is too big. Lg usually flash the system.img by braking it up to 10-15 pieces and flash these pieces after eachother. I will make a tot which flashes the system.img that way.

Do you still have twrp on your phone? If so can you still boot into twrp?
 
  • Like
Reactions: efrant

JaCh0o

New member
Aug 16, 2011
134
9
0
Thanks for the feedback. The error is this



Probably it is because of the 3gb system.img I try to flash is too big. Lg usually flash the system.img by braking it up to 10-15 pieces and flash these pieces after eachother. I will make a tot which flashes the system.img that way.

Do you still have twrp on your phone? If so can you still boot into twrp?
Thank you very much for soo much help... :)
I discovered this too while trying to flash newer system. Its impossible to flash-all by fastboot (zip concering all the main images with system 3gb) becuose of that. It goes successful only while manual flash every partition alone (while fastboot flash system system.img it sparse file into ~512MB parts).
No TWRP, got stock recovery. I thought i have failed and have to send it to LG Service Center, therefore i flashed original recovery (to make it as stock as possible).

Eagerly waiting for new tot file...

PS. I've found out that MBR08L and MBR08M have same release date (1. November 2015), I've tried to flash M version and on welcome screen phone asked me to choose gmt settings (where i didn't found nor Poland or Central Europe), while in L version it doesn't asks and put this settings properly by default. Is it possible that L i for poor countries and M is for States and wealthy ones ??
 
Last edited:

bitdomo

New member
Nov 3, 2011
1,542
1,240
0
28
Göd
Thank you very much for soo much help... :)
I discovered this too while trying to flash newer system. Its impossible to flash-all by fastboot (zip concering all the main images with system 3gb) becuose of that. It goes successful only while manual flash every partition alone (while fastboot flash system system.img it sparse file into ~512MB parts).
No TWRP, got stock recovery. I thought i have failed and have to send it to LG Service Center, therefore i flashed original recovery (to make it as stock as possible).

Eagerly waiting for new tot file...

PS. I've found out that MBR08L and MBR08M have same release date (1. November 2015), I've tried to flash M version and on welcome screen phone asked me to choose gmt settings (where i didn't found nor Poland or Central Europe), while in L version it doesn't asks and put this settings properly by default. Is it possible that L i for poor countries and M is for States and wealthy ones ??
Try now https://mega.nz/#!c4AmlCTT!LS1urRD8PRpK6y9kygbvonyi95zNWFHHe7PBNzzJLak

That M and L thing is just nonsense. If it were that the case then google would have done 2 seperate download sections for the two variants of nexus 5x on it's stock rom download page.
 
  • Like
Reactions: JaCh0o

JaCh0o

New member
Aug 16, 2011
134
9
0

Attachments

bitdomo

New member
Nov 3, 2011
1,542
1,240
0
28
Göd
Still error on 17 sec. Log attached. After successful restoring of nexus soft can i flash immediatly (by fastboot) m version of soft?
Ah I was wrong. The problem is the size of the modem.img (57973760 bytes) and not the system.img. I still have to figure it out what is wrong with the size.
If you manage to flash the tot file you can flash whatever rom you want with fastboot after you enable oem unlocking and unlock bootloader.
 
  • Like
Reactions: JaCh0o

JaCh0o

New member
Aug 16, 2011
134
9
0
Ah I was wrong. The problem is the size of the modem.img (57973760 bytes) and not the system.img. I still have to figure it out what is wrong with the size.
If you manage to flash the tot file you can flash whatever rom you want with fastboot after you enable oem unlocking and unlock bootloader.
Ok. I'm waiting for next tots for check.
 

gee one

New member
Jul 29, 2010
1,979
865
0
linux command line
Ah I was wrong. The problem is the size of the modem.img (57973760 bytes) and not the system.img. I still have to figure it out what is wrong with the size.
If you manage to flash the tot file you can flash whatever rom you want with fastboot after you enable oem unlocking and unlock bootloader.
modem partition sizes in bytes. I think modemstN are the EFS partitions.

Code:
90177536 modem
1572864 modemst1
1572864 modemst2
 
Our Apps
Get our official app! (coming soon)
The best way to access XDA on your phone
Nav Gestures
Add swipe gestures to any Android
One Handed Mode
Eases uses one hand with your phone