[Sprint LG G8] Bootloader Unlocking and Permanent Root Guide

Search This thread

skygunner

Senior Member
Mar 8, 2007
62
1
Brisbane
With this unlocking and root, if I dont want it anymore, can I flash back, unroot and lock again?

When its unlocked and rooted I guess theres no OTA updates anymore, so can I still update the phone further afterwards? Maybe through manual flashing?
 

Android#

Senior Member
Apr 18, 2016
158
91
A word of caution anyone trying to unlock bootloader or cross flash a Sprint variant of LG G8, be very careful in following the above instructions or instructions from threads that are linked in this thread. One small mistake or failed flash and be willing/prepared to permanently brick your phone.

After i tried to switch slots phone just powered off after the !CTROL POFF command and it never booted up again. While i can't be sure if it was switching slots or flashing partitions using Qfill that caused my phone to brick, it did brick. I did get the phone to go into EDL mode a few times but flashing to partitions with Qfill failed each time (it would flash fine without any Sahara or other errors but it wouldn't go into download or fastboot modes or boot up and I would try again). I even tried to flash the partitions with backups i made before I started this but even that failed. I tried switching cables and ports. I have another phone an LG V35 which i have used with Qfill a lot and it goes into 9008 mode and flashes fine with the same setup.

After a few times into EDL mode using the power and vol + and vol - buttons, it even stopped going into EDL mode. I think the phone stopped charging the battery. I even tried wireless charger to no avail. As a last resort, I opened the back and tried to short the test points to force phone into EDL mode. That failed too. A dead battery would explain this but I can't be sure that's what the problem was. Anyhow this post is just meant to be a word of caution to others. If your phone is working without unlocking bootloader or crossflashing be very careful in attempting this. I wish i had left my phone alone, it worked great, I just wanted to get VOLTE and Wi-Fi calling enabled on T-Mobile. Even the guys in the Telegram group for LG G8/ LG V50 group could not help me except for using teamviewer and trying same troubleshooting steps that I already tried.
 

blaze2051

Senior Member
Jul 26, 2010
374
39
LG G7 ThinQ
LG V40
A word of caution anyone trying to unlock bootloader or cross flash a Sprint variant of LG G8, be very careful in following the above instructions or instructions from threads that are linked in this thread. One small mistake or failed flash and be willing/prepared to permanently brick your phone.

After i tried to switch slots phone just powered off after the !CTROL POFF command and it never booted up again. While i can't be sure if it was switching slots or flashing partitions using Qfill that caused my phone to brick, it did brick. I did get the phone to go into EDL mode a few times but flashing to partitions with Qfill failed each time (it would flash fine without any Sahara or other errors but it wouldn't go into download or fastboot modes or boot up and I would try again). I even tried to flash the partitions with backups i made before I started this but even that failed. I tried switching cables and ports. I have another phone an LG V35 which i have used with Qfill a lot and it goes into 9008 mode and flashes fine with the same setup.

After a few times into EDL mode using the power and vol + and vol - buttons, it even stopped going into EDL mode. I think the phone stopped charging the battery. I even tried wireless charger to no avail. As a last resort, I opened the back and tried to short the test points to force phone into EDL mode. That failed too. A dead battery would explain this but I can't be sure that's what the problem was. Anyhow this post is just meant to be a word of caution to others. If your phone is working without unlocking bootloader or crossflashing be very careful in attempting this. I wish i had left my phone alone, it worked great, I just wanted to get VOLTE and Wi-Fi calling enabled on T-Mobile. Even the guys in the Telegram group for LG G8/ LG V50 group could not help me except for using teamviewer and trying same troubleshooting steps that I already tried.
did you follow guide to a T and flash 5x times for each file?
 

blaze2051

Senior Member
Jul 26, 2010
374
39
LG G7 ThinQ
LG V40
I ran into the same issue on one of my slots. Here is what I did and worked. Be careful though.

Boot to slot A.
Install 10 from the KDZ via the LGUP tool.
Boot to slot B
Install PIE from the KDZ via LGUP tool.
Boot to slot A
Start over from step 2.

In addition to that, I actually locked the BL and started from the beginning.
so in order to switch slots between A and B you need to install 9 and 10 and it boots into the last Os being isntalled?
 

blaze2051

Senior Member
Jul 26, 2010
374
39
LG G7 ThinQ
LG V40
so i messed up my phone after root and removing some system apps it wouldnt load either slot a or b. so i had to replace system.a.img from the zip file provided. thank you. that fixed my phone got rid of the sprint boot logo and i still had root , i then followed with installing twrp 3.3.1 via franco kernel manager i never did get a password pop up and when i went to wipe data only under advanced it failed each and every time. i did install the disable dm verity zip file 3.04.2020 and still could not wipe data. but after all that its up and running with twrp 3.3.1 root magisk v22 and android 10 v20d on sprint Lg G820um0
 

mangojain

Senior Member
Jul 24, 2010
214
21
After a few times into EDL mode using the power and vol + and vol - buttons, it even stopped going into EDL mode. I think the phone stopped charging the battery. I even tried wireless charger to no avail. As a last resort, I opened the back and tried to short the test points to force phone into EDL mode. That failed too. A dead battery would explain this but I can't be sure that's what the problem was. Anyhow this post is just meant to be a word of caution to others. If your phone is working without unlocking bootloader or crossflashing be very careful in attempting this. I wish i had left my phone alone, it worked great, I just wanted to get VOLTE and Wi-Fi calling enabled on T-Mobile. Even the guys in the Telegram group for LG G8/ LG V50 group could not help me except for using teamviewer and trying same troubleshooting steps that I already tried.
I've been in this situation, with the phone not even going into edl mode after a few failed flashing attempts, but shorting the edl points worked even though the battery was almost discharged. I can only suggest trying again, it might work.
I fiddled with my phone for exactly the same reasons as you, to get VoLTE and VoWiFi, reached a low point of not even booting into edl mode, but recovered by shorting the edl points, falshed a few files and got the phone to go into download mode, then flashed the kdz through LGUP and am happy to have the phone back as it was originally, seems it is impossible to make any changes to this phone, but maybe in future ...
 
  • Like
Reactions: Yevgen.A

spatial25

Member
Aug 29, 2021
20
3
Edit with a quick note: My apologies if I have misrepresented my involvement in the development of this method. I have gotten some PM's asking for help getting other devices unlocked. I should make it clear that my involvement only goes as far as #1. Putting this guide together and #2. Testing various different things. An extremely short and not at all comprehensive list of the real talent involved here would be people like White, j4nn, Vlad48, those are just the ones I know of.

After lots of work and testing, we now have a method of bootloader unlocking that is safe, if done properly, by flashing a V50 engineering bootloader. Note that you must be on a firmware version vulnerable to temp rooting for this to work, either in slot A or slot B. I've put together a comprehensive guide, as well as a zip containing all of the required files. It has been thoroughly vetted by the members primarily responsible for developing this method of bootloader unlocking. I'm providing a Google Drive link to a zip that includes the required files and the guide.

Currently, I'm looking for boot image dumps for those of you that are on 20j, 20m, 20a, 20b, and 20c. Right now the only Magisk patched boot images I have available are for 20d and 20e, however if you can dump your boot image I would be happy to patch it for you if you have a different firmware version.

Please report back with your feedback and success.

[Update 6/01/2020] Minor corrections to guide. Separated guide from zip for easier updating in the future.
Required Files - https://drive.google.com/file/d/1H08suuBBmHqttfMLZqBfy9yCDoAWylNy/view?usp=sharing
Guide - https://drive.google.com/file/d/1M4oEa3jkF_ZZzl1SKc6tvQtukc-KEgXK/view?usp=sharing

Edit:
I've added the entirety of the guide in post #4 and #5, for those that would like to take a look without downloading the zip first. Just fyi the formatting may be a tad messed up as it was copy and pasted from LibreOffice.

Many people contributed to making this a possibility!
Thank you to:

[email protected]
Vlad48
j4nn
Antintin
Luis Rosado
Brigantti

And so many more. From devs to testers, the above list is miniscule compared to what should be up there. This is simply either who I know of and/or who I have interacted with directly. I'm more than happy to expand this list upon request if anyone that has contributed would like their name up there.
Does anyone have a sprint US G820UM or G850UM .KDZ to download?
 

orlandoblues

Member
Sep 11, 2021
5
0
guys, having 21d on ane slot and 21e on the other, i'm assuming there is nothing i can do to root. Correct? Is there a way to downgrade to a rootable version? Thank you
 

Top Liked Posts

  • There are no posts matching your filters.
  • 19
    Edit with a quick note: My apologies if I have misrepresented my involvement in the development of this method. I have gotten some PM's asking for help getting other devices unlocked. I should make it clear that my involvement only goes as far as #1. Putting this guide together and #2. Testing various different things. An extremely short and not at all comprehensive list of the real talent involved here would be people like White, j4nn, Vlad48, those are just the ones I know of.

    After lots of work and testing, we now have a method of bootloader unlocking that is safe, if done properly, by flashing a V50 engineering bootloader. Note that you must be on a firmware version vulnerable to temp rooting for this to work, either in slot A or slot B. I've put together a comprehensive guide, as well as a zip containing all of the required files. It has been thoroughly vetted by the members primarily responsible for developing this method of bootloader unlocking. I'm providing a Google Drive link to a zip that includes the required files and the guide.

    Currently, I'm looking for boot image dumps for those of you that are on 20j, 20m, 20a, 20b, and 20c. Right now the only Magisk patched boot images I have available are for 20d and 20e, however if you can dump your boot image I would be happy to patch it for you if you have a different firmware version.

    Please report back with your feedback and success.

    [Update 6/01/2020] Minor corrections to guide. Separated guide from zip for easier updating in the future.
    Required Files - https://drive.google.com/file/d/1H08suuBBmHqttfMLZqBfy9yCDoAWylNy/view?usp=sharing
    Guide - https://drive.google.com/file/d/1M4oEa3jkF_ZZzl1SKc6tvQtukc-KEgXK/view?usp=sharing

    Edit:
    I've added the entirety of the guide in post #4 and #5, for those that would like to take a look without downloading the zip first. Just fyi the formatting may be a tad messed up as it was copy and pasted from LibreOffice.

    Many people contributed to making this a possibility!
    Thank you to:

    [email protected]
    Vlad48
    j4nn
    Antintin
    Luis Rosado
    Brigantti

    And so many more. From devs to testers, the above list is miniscule compared to what should be up there. This is simply either who I know of and/or who I have interacted with directly. I'm more than happy to expand this list upon request if anyone that has contributed would like their name up there.
    3
    TMobile G820TM unlock stuff

    The files needed to unlock
    https://www.androidfilehost.com/?fid=8889791610682884889

    I updated the Sprint unlock files from the main post to have the TMobile files needed to unlock under the 20D January 2020 Android 10 firmware. If you are not on that firmware especially due to being updated to the April 2020 Android 10 firmware you will need to downgrade to January 2020 as April 2020 has the exploit we are using patched. You can use the PDF guide from the main post as that pretty much covers bootloader unlocking the TMobile G8 in terms of each step very well.

    The KDZ for January 2020 is here towards the bottom of the page:
    https://lg-firmwares.com/lg-lmg820tm-firmwares/

    And here's the software you will need to get the job done:
    https://www.androidfilehost.com/?fid=8889791610682884898

    1. Install the LG drivers if you haven't already.
    http://tool.lime.gdms.lge.com/dn/downloader.dev?fileKey=UW00120120425

    2. Install LG Up
    3. Install the LG Common DLL
    4. Copy the UI confilg files to C:\Program Files (x86)\LG Electronics\LGUP\model\Common
    5. Turn off the G8.
    6. Once off hold up volume up then insert your USB into the phone.
    7. Open LG Up. If you get an error message ignore.
    8. Select REFURBISH in LG Up
    9. Load the KDZ file by drag and drop where it says BIN file
    10. Click start
    11. Once the downgrade is done installing the phone will reboot. I highly recommend not putting the phone on Wifi and turning off data to avoid any chances of the phone updating.

    Thanks to the many people in the Telegram chat for all the help I've gotten in unlocking the TMobile G8.
    3
    Sprint LG G8 Temp Root, BL Unlock, TWRP, & Magisk Guide

    Requirements

    A Sprint LG G8 with the one of the following configurations:

    A: Android 10 20e or lower and Pie on slots A/B or B/A.
    B: Android 10 20e or lower and Android 10 any firmware on slots A/B or B/A.

    1. LG 4.2 Drivers
    2. The latest available ADB Platform Tools
    3. Python 3.8.3 With PATH Set
    4. OEM Unlocking Enabled in Developer Settings
    5. ADB Debugging Enabled in Developer Settings
    6. The files mentioned throughout this guide. They will either have links or they will be provided in the forum post.

    Excellent reading comprehension and patience!

    Warnings

    1. You do this at your own risk!
    2. Be prepared to data wipe/factory reset a lot.
    3. There are some critical steps that you cannot get wrong or you risk a brick. Read very carefully, take your time.
    4. There are a lot of steps involved in this guide. If you are unsure in the slightest, do not make an assumption. Ask for clarification before you proceed.

    Step 1A, Firmware Check:

    First, you need to verify your current firmware version. Anything 20e or lower is currently vulnerable to the Temp Root exploit provided by j4nn.

    Open Settings > System > About Phone > Software Version, third line down. If your current version is 20f (the latest available from LG at the time of writing), your firmware is not vulnerable to the exploit and we will need to switch slots and check your firmware version there. It’s recommended that you factory data reset before performing this step to avoid the startup PIN lockout, regardless if you have one set or not, it will ask for a startup PIN and it WILL FAIL to unlock. Either way, you will be forced to factory reset.

    Follow this guide provided by Antintin to switch slots: https://forum.xda-developers.com/lg-g8/how-to/people-trying-beta-want-to-revert-t4011925. After switching, boot to Android. Skip the initial setup. Please take note which slot you switched to that contains the prior version of Android. SABS 0 is slot A, SABS 1 is slot B.

    If your current firmware version is vulnerable, skip to Step 2, Temp Rooting.

    Step 1B, Switching Slots:

    By this point, you will have switched to your inactive slot following the guide linked above and booted to Android. Follow the same steps listed above to check your firmware version. If you see anything lower than 20f, for example: 20a, 20b, 20c, 20d, 20e, this version is exploitable. If you have an exploitable firmware in this slot, continue to “Step 2, Temp Rooting”. If you do not have an exploitable firmware in this slot, the temp root exploit will not work and therefore, the bootloader unlock will not be possible.

    Step 2, Temp Rooting:

    Our next step is to achieve temp root on whichever slot is vulnerable. Follow this guide provided by j4nn and return here after you have temp root. https://forum.xda-developers.com/lg-g8/development/lg-g8-temp-root-exploit-via-cve-2020-t4100333

    After achieving temp root:

    Make a backup of your stock images. This step is not optional and if you skip it you do so at your own peril. No one is going to have a copy of your exact images. Copy and paste each line in your root shell and pull the images off your phone and keep them safe. There are also two scripts included with this guide, one that will automate the steps below, and the other that will perform a full backup of every partition. It’s recommended that you make a complete firmware backup. The images listed below are just the bare minimum.

    dd if=/dev/block/sda28 of=/storage/emulated/0/Download/OP_a.img
    dd if=/dev/block/sda29 of=/storage/emulated/0/Download/OP_b.img
    dd if=/dev/block/sda19 of=/storage/emulated/0/Download/carrier.img
    dd if=/dev/block/sde64 of=/storage/emulated/0/Download/catecontentfv.img
    dd if=/dev/block/sde63 of=/storage/emulated/0/Download/catefv.img
    dd if=/dev/block/sde57 of=/storage/emulated/0/Download/cateloader.img
    dd if=/dev/block/sdg1 of=/storage/emulated/0/Download/frp.img
    dd if=/dev/block/sdf5 of=/storage/emulated/0/Download/fsc.img
    dd if=/dev/block/sdf4 of=/storage/emulated/0/Download/fsg.img
    dd if=/dev/block/sda8 of=/storage/emulated/0/Download/ftm.img
    dd if=/dev/block/sda31 of=/storage/emulated/0/Download/grow.img
    dd if=/dev/block/sdf4 of=/storage/emulated/0/Download/fsg.img

    Running the backup script

    adb push backupall-part.sh /data/local/tmp

    Execute the following in a root shell:

    cd /data/local/tmp
    sh backupall-part.sh

    When complete, copy the backed up images from your internal storage Download folder to your computer.

    You are now ready to proceed with Bootloader unlocking. Leave your root shell open.

    Step 3A, Bootloader Unlocking:

    Before We Begin:

    A word of warning. These next steps involve issuing dd commands to overwrite your bootloader on your currently inactive slot (the active slot being the one you are on now with temp root) with a V50 engineering bootloader. This method has been performed at least half a dozen times without a brick. As long as you follow the instructions carefully, you should be fine.

    Secondly, if your inactive slot is not on firmware version 20d, we will have to flash the entire 20d backup to the inactive slot via fastboot flash commands or you will likely not boot or have an extremely unstable system. (See the amended “Step 4, Flashing 20d” step.) You can find the 20d backup here, provided by Luis: https://drive.google.com/file/d/1lXpO-sntmFmabDJ2dnfkQXqL6kEDvca0/view?usp=sharing

    The above link contains images for both 20d and Pie. The _a images are 20d, the _b images are Pie. If you do not already have one, and you would like a bootable Pie slot, you may flash the _b images to the slot containing the engineering bootloader. We will cover this topic in a later step. Do not attempt without reading the step, Bonus: Pie Slot, at the end of this guide.

    Moving On:

    We need to find out your current active slot. In your root shell, type, without the quotes, “getprop | grep slot”. If you are in slot A, continue to “Step 3B, Slot A dd Commands”. If you are in slot B, continue to “Step 3C, Slot B dd Commands”.

    Step 3B, Slot A dd Commands:

    The following dd commands will flash xbl, xbl_config, abl and laf from Pie, as well as the V50 engineering bootloader to slot B. Copy these images to your internal storage Download folder.

    Before We Begin:

    It is required that each of these commands be run at least 5 times to ensure proper flashing. If you’re going to brick, this is the time it’s going to happen. There is little risk as long as you flash the same images at least 5 times to ensure proper flashing.

    Secondly, if at any point the dd commands fail, reboot, regain temp root, and try again.

    Moving On:

    In your root shell, run the following at least 5 times for each image. For example, you will flash the V50 bootloader 5 times before moving on to the next dd command.

    1. dd if=/storage/emulated/0/Download/V500ES_abl_a.img of=/dev/block/bootdevice/by-name/abl_b

    2. dd if=/storage/emulated/0/Download/xbl_b.img of=/dev/block/bootdevice/by-name/xbl_b

    3. dd if=/storage/emulated/0/Download/xbl_config_b.img of=/dev/block/bootdevice/by-name/xbl_config_b

    4. dd if=/storage/emulated/0/Download/laf_b.img of=/dev/block/bootdevice/by-name/laf_b

    You can now exit the root shell by typing “exit” twice. This is required. Leave your cmd prompt or powershell window open.

    Switch to slot B by following the guide linked above in Step 1A, Firmware Check.

    Reboot to Fastboot while in slot B via the key combination volume down and power. Select the restart bootloader option using the volume keys, and the power button to confirm your selection. You must select restart bootloader or your device will not show up in fastboot devices even though you have booted to bootloader already!

    Type fastboot devices in your cmd prompt or powershell window. You should now see your device listed in fastboot mode.

    Type fastboot oem unlock, select Yes. You are now bootloader unlocked!

    If slot A does contain firmware version 20d, proceed to “Step 4A, Magisk Flashing”.
    If slot A does not contain firmware version 20d, proceed to “Step 4B, Flashing 20d”.

    Step 3C, Slot B dd Commands:

    The following dd commands will flash xbl, xbl_config, abl and laf from Pie, as well as the V50 engineering bootloader to slot A. Copy these images to your internal storage Download folder.

    Before We Begin:

    It is required that each of these commands be run at least 5 times to ensure proper flashing. If you’re going to brick, this is the time it’s going to happen. There is little risk as long as you flash the same images at least 5 times to ensure proper flashing.

    Secondly, if at any point the dd commands fail, reboot, regain temp root, and try again.

    Moving On:

    In your root shell, run the following at least 5 times for each image. For example, you will flash the V50 bootloader 5 times before moving on to the next dd command.

    1. dd if=/storage/emulated/0/Download/V500ES_abl_a.img of=/dev/block/bootdevice/by-name/abl_a

    2. dd if=/storage/emulated/0/Download/xbl_b.img of=/dev/block/bootdevice/by-name/xbl_a

    3. dd if=/storage/emulated/0/Download/xbl_config_b.img of=/dev/block/bootdevice/by-name/xbl_config_a

    4. dd if=/storage/emulated/0/Download/laf_b.img of=/dev/block/bootdevice/by-name/laf_a

    You can now exit the root shell by typing “exit” twice. This is required. Leave your cmd prompt or powershell window open.

    Switch to slot A by following the guide linked above in Step 1A, Firmware Check.

    Reboot to Fastboot while in slot A via the key combination volume down and power. Select the restart bootloader option using the volume keys, and the power button to confirm your selection. You must select restart bootloader or your device will not show up in fastboot devices even though you have booted to bootloader already!

    Type fastboot devices in your cmd prompt or powershell window. You should now see your device listed in fastboot mode.

    Type fastboot oem unlock, select Yes. You are now bootloader unlocked!

    If slot B does contain firmware version 20d, proceed to “Step 4A, Magisk Flashing”.
    If slot B does not contain firmware version 20d, proceed to “Step 4B, Flashing 20d”.
    3
    Step 4A, Magisk Flashing:

    The next step is to flash the appropriate Magisk patched boot image for your firmware version. The following commands needs to be changed based on which slot your 20[a,b,c,d,e] firmware is located, and which patched image you’re flashing. For example, if 20d is in slot A, you will use “boot_a”, if it’s in slot B, you will use “boot_b”. Likewise, if 20d is in slot A, you will use “fastboot --set-active=a”, if it’s in slot B, you will use “fastboot --set-active=b”. Note: That’s a double dash before “set”.

    fastboot flash boot_a sprint20d_magisk_patched.img
    fastboot --set-active=a

    Select power off, press the power button to confirm selection. It may take upwards of 10 – 20 seconds to get the phone to turn back on after powering off. This is normal. Boot to Android. If you have a successful boot, skip the initial setup and proceed to “Step 5, Finishing Up”.

    Step 4B, Flashing 20d:

    I’m leaving this step here in case it is needed. After some testing, we have determined that no stability problems occur as long as you flash a patched boot image that matches your current firmware version. Currently we have patched 20d and 20e boot images available.

    For this step, you will need the 20d backup found in “Step 3A, Bootloader Unlocking”. As mentioned before, the _a images are 20d, the _b images are pie. You will only need the _a 20d images for this step.
    This cannot be skipped if you are on anything other than 20d. You will have severe system problems IF it even boots at all. The process is straight forward, just slightly time consuming. Lets begin.
    Extract the _a 20d images in the g820um20d.zip to your root Android folder containing your platform tools. Each and every image will need to be flashed, in no particular order. Just sort by file type and start from the top. The image file names directly correlate to the partition you are flashing to, for example: abl_a.img will be flashed to abl_a, and so on.
    The following fastboot flash commands will need to be changed based on your primary slot letter (the slot that does NOT contain the engineering bootloader). For example, if that happens to be slot B, you will use fastboot flash abl_b abl_a.img, and so on.
    fastboot flash abl_a abl_a.img
    fastboot flash akmu_a akmu_a.img
    And so on, it’s that simple. The only exception is the boot image. You will NOT flash the boot_a image, you will flash the Sprint20D magisk patched image instead.
    Once complete execute the following:
    fastboot erase userdata
    fastboot --set-active=a or --set-active=b based on your primary slot letter.
    Select power off, press the power button to confirm selection. It may take upwards of 10 – 20 seconds to get the phone to turn back on after powering off. This is normal. Boot to Android. If you have a successful boot, skip the initial setup and proceed to “Step 5, Finishing Up”.

    Step 5, Finishing Up:
    In this step we will flash TWRP, reboot to recovery, flash Magisk and dm-verity disabler. An SD card is recommended but not required for this step.

    Copy the Disable_Dm-Verity zip, Magisk-v20.4.zip, and the twrp-installer zip to your SD card. Preferably to the Download folder. If you’re using internal storage only, you will move these files to the phone after you data wipe in TWRP.

    Download the latest version of the Magisk Manager APK and install it.

    Once installed, open Magisk Manager. It will ask you to perform additional setup. Allow it. The phone will reboot automatically. After the reboot, open Magisk Manager once more, tap on the 3 horizontal bars on the top left, and select Modules.
    Tap the Plus sign and select the twrp-installer zip. This will flash TWRP. Note that in doing so, this will remove Magisk from the boot image. This is fine.

    Shut down the phone and boot to recovery via the key combination. Hold volume down and power until you see Recovery mode flash on screen, you may release the buttons after you see this. You should now be in TWRP. Tap cancel when it asks for a password. Go to Wipe > Advanced > Select data (and only data), and wipe. Reboot the phone back to recovery. Do not let the system boot after data wiping. Go directly back to TWRP. You will NOT brick, however you will have to data wipe and reboot again.

    After you’re back in TWRP, it should no longer be asking you for a password. This is good, it means we have removed the encryption.
    Next, tap Install. Flash in this order Magisk-v20.4.zip, followed by a reboot directly to TWRP. Next, flash Disable_Dm-Verity. Reboot to system. Continue setup as normal.

    Congratulations! You are now bootloader unlocked and rooted.

    Bonus: Pie Slot:
    As mentioned in “Step 3A, Bootloader Unlocking”, if you do not have a Pie slot, you can flash the Pie images in the zip mentioned in the same step via fastboot flash, the same way you (may have) flashed 20d in “Step 4B, Flashing 20d”. The only difference is you will be flashing all of the _b images except for abl, xbl, and xbl_config to the slot containing the engineering bootloader. You must fastboot erase userdata after flashing the Pie images. Once complete, simply reboot and you should have a bootable Pie slot. Please note that the V50 engineering bootloader prevents the touch screen from working in Pie.
    2
    Me , antitin and Brandon successfully BL unlocked, if you follow the steps to the T, you will be bl unlock.