[UNLOCK][UNOFFICIAL][G4] Unlock ANY* LG G4 device with UsU

[guillefs]

Unfortunately not. The only thing i can say is it is hardware related then. Maybe you touched a sensor or just a bit too much pressure at the wrong place.. Even though it is a replace friendly phone doing that is like balancing raw eggs while driving the highway on a motor bike.



Sent from my OnePlus 7T Pro using XDA Labs

Yes, it could be that when changing the motherboard several times I have tightened the connector of the screen too much and some pin of the touch is unsoldered.

The strangest thing is that at times when the battery is complete it works almost perfect.

 

[marcelrobitaille]

TWRP not showing REAL device model when connected to the PC

I followed the instructions diligently, but TWRP is still not showing the correct model name in my computer. If I try to flash a rom, I get: "E3004: This package is for device: g4,p1,h812; this device is �ro.product.name."

recovery.log: https://bpa.st/X7NQ (sorry, I'm not allowed to post outside links)
dmesg.txt: https://paste.omnirom.org/view/46bc2931
ROM I'm trying to flash: Your build of Lineage OS
ROM version: MM
Not encrypted
H812

 

[steadfasterX]

I followed the instructions diligently, but TWRP is still not showing the correct model name in my computer. If I try to flash a rom, I get: "E3004: This package is for device: g4,p1,h812; this device is �ro.product.name."

recovery.log: https://bpa.st/X7NQ (sorry, I'm not allowed to post outside links)
dmesg.txt: https://paste.omnirom.org/view/46bc2931
ROM I'm trying to flash: Your build of Lineage OS
ROM version: MM
Not encrypted
H812

This can happen in rare cases just follow faq 25 and it will be fixed



Sent from my OnePlus 7T Pro using XDA Labs

 

[marcelrobitaille]

This can happen in rare cases just follow faq 25 and it will be fixed



Sent from my OnePlus 7T Pro using XDA Labs

Worked a charm! Thank you sir!

 

[baran1706]

i have read this thread, maybe i have miss, is there a way to unlock device with ARB 3?
i have LG G4 H810 with ARB 3

 

[ThePiGuy]

i have read this thread, maybe i have miss, is there a way to unlock device with ARB 3?
i have LG G4 H810 with ARB 3

Unfortunately not. ARB 2 or lower is required (see Requirement 2 in the main post for more info)

 

[Sazobaer]

Im getting ERROR 7&6 While flashing Custom rom in TWRP How to Solve?

I unlocked my device with this technique...so thanks for that....But now I cant Able to flash any Custom Roms They Getting erro7 ...but i Figured it out and solve that....but after solve error7 its getting error 6 in twrp when i tryed to flash..(Im in lp H815 10c and i finished Your Usu Unlock method while having Lp)so my software is lp till now......I tryed many Ways But any one of them didn't worked (execept just error7 . by removing assert line from the update.script of that rom..but after finishing that..im having error6) plz plz plz plz plz plz plz plz plz plzZzzzZZZZZZzzzzZZZ
Help me out SteadyFasterX....Appreciate for Usu guide ...but Now I need help!!!!!!:crying::crying:

 

[steadfasterX]

I unlocked my device with this technique...so thanks for that....But now I cant Able to flash any Custom Roms They Getting erro7 ...but i Figured it out and solve that....but after solve error7 its getting error 6 in twrp when i tryed to flash..(Im in lp H815 10c and i finished Your Usu Unlock method while having Lp)so my software is lp till now......I tryed many Ways But any one of them didn't worked (execept just error7 . by removing assert line from the update.script of that rom..but after finishing that..im having error6) plz plz plz plz plz plz plz plz plz plzZzzzZZZZZZzzzzZZZ
Help me out SteadyFasterX....Appreciate for Usu guide ...but Now I need help!!!!!!:crying::crying:

You're aware that unlocking on LP is not recommended?
These error numbers are useless.. A log is needed.

But the first thing you should do is upgrading your bootloader stack to 20p otherwise you will have issues with any ROM later. That's just ONE of the reasons why it's clearly mentioned in the guide to be on MM before unlocking. If you dont have a SALT backup ensure you do one NOW! Only when you have a backup flash this in TWRP: h815_UsU_20p_bootloader_20p_modem_TWRP-flashable.zip

From here: http://leech.binbash.rocks:8008/stock/LG/h815/20p/

Then reboot to TWRP
Then reproduce your issue and share the recovery log (see the guide in my signature).


Sent from my OnePlus 7T Pro using XDA Labs

 

[Sazobaer]

Error6 Still Happening! I flashed the 20p bootloader stack but still its getting Er6.

I flashed that 20pBootloader stack ...but i still can't flashed custom roms..im getting error 6 or7 again and again.. The whole Twrp Log below...Help!

________________________________________________________________________________________________________________________

IREPDEC: 2015-01-01_02:10:05 - Started /sbin/prepdecrypt.sh
I:TUNESD: 2015-01-01_02:10:05 - Started /sbin/tunesd.sh
IREPDEC: 2015-01-01_02:10:05 - syspath: /dev/block/platform/soc.0/f9824900.sdhci/by-name/system
I:READTIME: 2015-01-01_02:10:06 - Starting /sbin/readtimeprop.sh
I:SYMLINK: 2015-01-01_02:10:06 - Starting /sbin/createsym.sh
I:READTIME: 2015-01-01_02:10:06 - timeadjust before setprop: ><
I:SYMLINK: 2015-01-01_02:10:06 - bootdevice check before actually doing anything: ><
Starting TWRP 3.4.0-PREVIEW-224_g4_O-12f830c6-dirty on Thu Jan 1 02:10:06 2015
(pid 371)
RECOVERY_SDCARD_ON_DATA := true
TW_NO_USB_STORAGE := true
TW_INCLUDE_CRYPTO := true
I:Find_File: Error opening '/sys/class/backlight'
I:Found brightness file at '/sys/class/leds/lcd-backlight/brightness'
I:Got max brightness 255 from '/sys/class/leds/lcd-backlight/max_brightness'
I:TWFunc::Set_Brightness: Setting brightness control to 200
I:LANG: en
Starting the UI...
setting DRM_FORMAT_RGBX8888 and GGL_PIXEL_FORMAT_RGBX_8888
IREPDEC: 2015-01-01_02:10:06 - Preparing directories:
mkdir: can't create directory '/vendor': File exists
cannot find/open a drm device: No such file or directory
fb0 reports (possibly inaccurate):
vi.bits_per_pixel = 32
vi.red.offset = 0 .length = 8
vi.green.offset = 8 .length = 8
vi.blue.offset = 16 .length = 8
I:READTIME: 2015-01-01_02:10:06 - checking for twrp fstab
'/dev/block/bootdevice' -> '/dev/block/platform/soc.0/f9824900.sdhci'
I:READTIME: 2015-01-01_02:10:06 - No twrp fstab which includes /system generated yet! will wait until its there..
setting GGL_PIXEL_FORMAT_RGBA_8888
double buffered
framebuffer: 0 (1440 x 2560)
I:SYMLINK: 2015-01-01_02:10:06 - bootdevice check after fixing the symlink: >lrwxrwxrwx 1 root root 40 Jan 1 02:10 bootdevice -> /dev/block/platform/soc.0/f9824900.sdhci<
I:SYMLINK: 2015-01-01_02:10:06 - /sbin/createsym.sh finished with <0>
IREPDEC: 2015-01-01_02:10:06 - preparing libraries...
cp: can't stat '/s/bin/hwservicemanager': No such file or directory
cp: can't stat '/s/lib64/libhidltransport.so': No such file or directory
cp: can't stat '/s/lib64/libhidlbase.so': No such file or directory
cp: can't stat '/s/lib64/libhwbinder.so': No such file or directory
cp: can't stat '/s/vendor/lib64/hw/keystore.msm8992.so': No such file or directory
cp: can't stat '/s/vendor/lib64/hw/gatekeeper.msm8992.so': No such file or directory
cp: can't stat '/s/vendor/lib64/hw/gatekeeper.msm8992.so': No such file or directory
cp: can't stat '/s/vendor/lib64/hw/keystore.msm8992.so': No such file or directory
cp: can't stat '/s/vendor/lib64/libmdtp.so': No such file or directory
IREPDEC: 2015-01-01_02:10:06 - preparing libraries finished
IREPDEC: 2015-01-01_02:10:06 - crypto.ready: 1
IREPDEC: 2015-01-01_02:10:06 - current mounts:
rootfs on / type rootfs (rw,seclabel)
tmpfs on /dev type tmpfs (rw,seclabel,nosuid,relatime,mode=755)
devpts on /dev/pts type devpts (rw,seclabel,relatime,mode=600)
proc on /proc type proc (rw,relatime,gid=3009,hidepid=2)
sysfs on /sys type sysfs (rw,seclabel,relatime)
selinuxfs on /sys/fs/selinux type selinuxfs (rw,relatime)
none on /acct type cgroup (rw,relatime,cpuacct)
tmpfs on /tmp type tmpfs (rw,seclabel,relatime)
pstore on /sys/fs/pstore type pstore (rw,seclabel,relatime)
adb on /dev/usb-ffs/adb type functionfs (rw,relatime)
adb on /dev/usb-ffs/adb type functionfs (rw,relatime)
IREPDEC: 2015-01-01_02:10:06 - /sbin/prepdecrypt.sh ended
I:READTIME: 2015-01-01_02:10:08 - No twrp fstab which includes /system generated yet! will wait until its there..
I:READTIME: 2015-01-01_02:10:10 - No twrp fstab which includes /system generated yet! will wait until its there..
Using fbdev graphics.
I:TWFunc::Set_Brightness: Setting brightness control to 200
I:Loading package: splash (/twres/splash.xml)
I:Load XML directly
IageManager::LoadFileToBuffer loading filename: '/twres/splash.xml' directly
I:Checking resolution...
I:Scaling theme width 1.333333x and height 1.333333x, offsets x: 0 y: 0 w: 0 h: 0
I:Loading resources...
I:Loading variables...
I:Loading mouse cursor...
I:Loading pages...
I:Loading page splash
I:Switching packages (splash)
=> Linking mtab
=> Processing /etc/recovery.fstab for SAR-detection
I:Reading /etc/recovery.fstab
Ione processing fstab files
I:SAR-DETECT: Non-SAR System detected
=> Processing /etc/recovery.fstab
I:Reading /etc/recovery.fstab
Irocessing '/boot'
Irocessing '/recovery'
Irocessing '/system'
Irocessing '/data'
Irocessing '/cache'
Irocessing '/firmware'
Irocessing '/persist-lg'
Irocessing '/firmware_image'
Irocessing '/factory'
Irocessing '/efs1'
Irocessing '/efs2'
Irocessing '/efs3'
Irocessing '/external_sd'
I:Created '/external_sd' folder.
Irocessing '/usb-otg'
I:Created '/usb-otg' folder.
Irocessing '/misc'
Irocessing '/rmisc'
Irocessing '/devinfo'
Irocessing '/persist'
Irocessing '/persistent'
Irocessing '/drm'
Irocessing '/sns'
Irocessing '/bl'
Irocessing '/bl2'
Irocessing '/bl3'
Irocessing '/bl4'
Irocessing '/bl5'
Irocessing '/bl6'
Irocessing '/bl7'
Irocessing '/bl8'
Irocessing '/carrier'
Irocessing '/cust'
Ione processing fstab files
I:Setting up '/data' as data/media emulated storage.
I:mount -o bind '/data/media' '/sdcard' process ended with RC=0
I:mount -o bind '/data/media/0' '/sdcard' process ended with RC=0
I:Trying wrapped key.
I:Unable to decrypt device
I:Setting up '/data' as data/media emulated storage.
I:mount -o bind '/data/media/0' '/sdcard' process ended with RC=0

 

[steadfasterX]

I flashed that 20pBootloader stack ...but i still can't flashed custom roms..im getting error 6 or7 again and again.. The whole Twrp Log below...Help!

you havent followed my guide, otherwise you would have used a paste service.
you havent followed my request otherwise you would have tried to re-produce the issue (trying to flash something) and THEN grab the log.


.-

 

[Sazobaer]

I'm Doomed!!

After successfuly doing usu unlock every think seems fine but I had no root access to o tryed to root by flashing SuperSU zip in recovery but it doesn't work..after that i tryed many times to install the lineage os 16 but it's not flashing too...so iv tried to wiped my system data and cache and the iv tried but same it's getting failed with errors when iv try to install that rom...iv tried to access with my computer via adb but adb can't able to find any device... neither other software like lg up...I can't access my system neither recovery nor fastboot or download mode cuz it's not opening iv charged.my phone enough to I has charge but it's still not responsing what should I do now..if there's away to fix plz plz help me !
I love my phone so much:crying::crying::crying:

 

[steadfasterX]

After successfuly doing usu unlock every think seems fine but I had no root access to o tryed to root by flashing SuperSU zip in recovery but it doesn't work..after that i tryed many times to install the lineage os 16 but it's not flashing too...so iv tried to wiped my system data and cache and the iv tried but same it's getting failed with errors when iv try to install that rom...iv tried to access with my computer via adb but adb can't able to find any device... neither other software like lg up...I can't access my system neither recovery nor fastboot or download mode cuz it's not opening iv charged.my phone enough to I has charge but it's still not responsing what should I do now..if there's away to fix plz plz help me !
I love my phone so much:crying::crying::crying:

ok
1. supersu is from the last century and is end-of-life. use magisk.
2. what happens when you boot in the recovery mode? Follow the exact procedure in the OP (see changes in behavior)
3. if the screen just keeps black whatever you try (booting to fastboot, booting to recovery, booting to download mode) you might get hit by the ILAPO, see FAQ #14

.-

 

[coder.toolbox]

device firmware must be MM

Hello @steadfasterX,

I'm working through this LG G4 tutorial to unlock my newly acquired phone.
Caveat: I bought it via AliExpress as a H815, but SALT reports it as a "device model: LG-H810, GPT comp: H811".
I took a screenshot and uploaded it on imgbb: ibb.co/9hRsXCj.
Within the device it states that the Android version is 5.1.

So now I'm stuck at "device firmware must be MM".
- firmware laf: H81010o
- firmware system: LGH815AT-00-V10h-GLOBAL-US-AUG-17-2015-ARB02+0

How would I go to upgrade this device to MM? [I tried already LG Bridge, but likely because it's a so-called "Frankenstein" device it wasn't able to update itself.]

Thanks!

 

[steadfasterX]

Hello @steadfasterX,

I'm working through this LG G4 tutorial to unlock my newly acquired phone.
Caveat: I bought it via AliExpress as a H815, but SALT reports it as a "device model: LG-H810, GPT comp: H811".
I took a screenshot and uploaded it on imgbb: ibb.co/9hRsXCj.
Within the device it states that the Android version is 5.1.

So now I'm stuck at "device firmware must be MM".
- firmware laf: H81010o
- firmware system: LGH815AT-00-V10h-GLOBAL-US-AUG-17-2015-ARB02+0

How would I go to upgrade this device to MM? [I tried already LG Bridge, but likely because it's a so-called "Frankenstein" device it wasn't able to update itself.]

Thanks!

...and another Frankenstein ...

The most important first:
Unlocking is always a risk. Well known. Unlocking a Frankenstein is like a lottery though. No one knows what they did at bootloader level.

At least 1 thing is sure: you have an ARB of 2. That's the most important part as it means if you would flash a h815 bootloader or kdz it would immediately brick.

So your model MIGHT be a h810. The only way to be sure is viewing at the mainboard as written in the faq. Even then this does bot necessarily mean that it behaves like a h810 as they modified the bootloader to be able to boot a h815 ROM. So who knows what would happen if you treat it like a h810?!

Other then that SALT detected a h810 bootloader which is usually pretty accurate but again .. Frankensteins are not usual.

Anyways if you just wanna take the risk then flash UsU and afterwards flash the bootloader stack of the h810 as described in the faq. You can do that easily by TWRP once installed.
The TWRP flashable download for that is here then:
http://leech.binbash.rocks:8008/stock/LG/h810/20n/
Ensure you download h810_20n_UsU_bootloader_ARB2.zip (so the UsU one).

Just to be clear you were TRICKED by ali express! I would try to get my money back as this is 100% no h815..

Ali express is full of frankensteins btw.



Sent from my OnePlus 7T Pro using XDA Labs

 

[coder.toolbox]

...and another Frankenstein ...

Sadly enough yes . But who doesn't love a challenge?
Anyway. I love the G4 phone a lot, so to me it's worth the efforts.

After disassembly (I took pictures so I can make a Franken-root tutorial later on ), the backside of the main board shows:
- EAX66488601_VS986_MAIN_1.0 (2)
- RISU80 (or something like that??) 94V-0X 1612K

The other main board had "EAX66473001_1.0_F500L_MAIN" on it. So that's an F500 bootloader I need right?

So, based on, for the first I assume I need the VS986 partition instead of the H810 right? And for the second I don't see a bootloader on your leech site?
(fun: is it H815, H810, H811, VS986, F500, ... ? wtf do they do there in China?)

Anyways if you just wanna take the risk then flash UsU and afterwards flash the bootloader stack of the h810 as described in the faq. You can do that easily by TWRP once installed.

Based on the numbers on the mainboard I would need to take the "vs986_2BA_UsU_bootloader_arb2.7z" instead, no?
I don't know if these are compatible though. It's both arb2, so I wouldn't hard-brick the device, I think?

Just to be clear you were TRICKED by ali express! I would try to get my money back as this is 100% no h815..

I could send it back, but that would cost about as much as buying a new phone. They offered me a $5 refund though. So not bothering with the refund and going to try to root it anyhow.
Found a European variant on a 2nd hand site over here for €15 (broken glass, but otherwise workable -- H815 + arb0 + Android 6.0). So that one would go much smoother anyway. Will see how that goes after I get it.

 

[steadfasterX]

Sadly enough yes . But who doesn't love a challenge?
Anyway. I love the G4 phone a lot, so to me it's worth the efforts.

After disassembly (I took pictures so I can make a Franken-root tutorial later on ), the backside of the main board shows:
- EAX66488601_VS986_MAIN_1.0 (2)
- RISU80 (or something like that??) 94V-0X 1612K

So, based on, that I assume I need the VS986 partition instead of the H810 right?
(fun: is it H815, H810, H811, VS986, ... ? wtf do they do there in China?)


Based on the numbers on the mainboard I would need to take the "vs986_2BA_UsU_bootloader_arb2.7z" instead, no?
I don't know if these are compatible though. It's both arb2, so I wouldn't hard-brick the device, I think?


I could send it back, but that would cost about as much as buying a new phone. They offered me a $5 refund though. So not bothering with the refund and going to try to root it anyhow.
Found a European variant on a 2nd hand site over here for €15 (broken glass, but otherwise workable -- H815 + arb0 + Android 6.0). So that one would go much smoother anyway. Will see how that goes after I get it.

woa.. yea a Frankenstein puzzle as it can't be better.
ok so if you wanna go that route I would first search for 2 things: vs986 QFIL files and H810 QFIL files. Both must be on ARB 2 - not lower - not higher.
you can verify the ARB with linux (u need mAid anyways) so find the sbl1.img in the QFIL package and do this in a terminal (right click within the folder in mAid -> open in terminal):

strings sbl1.img | grep SW_ID

the long chain of numbers has in its 6th or 7th digit the ARB level , or share the output here.

It is hard to completely hard hard brick a LG G4 thats the good point. When you have QFIL or a box like infinity etc you can recover from almost every brick (other then ARB mistakes)

once you got that I would go on with the h810 tbh. I mean it might hard brick - thats why you should have QFIL prepared - but if the current bootloader stack is h810 its better then the vs986 one.
vs986 might have issues when in Verizon network but if that does not affect you it is maybe not a big deal.
anyways I would flash the h810 bootloader stack and if it bricks use QFIL to bring up the vs986 one first.

either they modded the bootloader stack or they modded the PBL (read-only flash) to be able to load a h810 bootloader. Even then .. I mean why modding it to load a h810 bootloader instead of the vs986 one? The only thing I can think of is that the vs986 may act a bit different for the radio/baseband so they wanted to avoid that and as you cannot remove fuses (i.e. ARB) they took the h810 one.. well just guessing here. but if (and thats still a question) this is a h810 bootloader stack I would go on with that one.

.-

 

[coder.toolbox]

:good: Check on the ARB, I'm extra careful around that one .

So from your comments I understand:
- Hardware: VS986
- Bootloader: H810
- Software (faked?): H815

I would first search for 2 things: vs986 QFIL files and H810 QFIL files.

Problem: I found a bunch now (H810 Fix By QFIL -- SW_ID included 00..2..00 so arb2).
I also found rooted tot files... At least that's what the name suggests: for example: "LGH810AT-00-V10o-ATT-FixFull-Rooted.tot"
And I found some 512MB dump files... I vaguely remember seeing another post discussing here that you could extract partitions from it, but I fail to find that post again. But I also remember reading somewhere that you needed leaked qfil files to be able to use this method (correct?)?

Anyway, H810 qfil found, no vs986 except for some dumps (all arb2 -- 13b kdz, 24c kdz & dump, 25a kdz & dump, 27c kdz & dump).

I added a few of the files into a mega drive: mega.nz/folder/0wUwASIC#sQHqSNKoRAzmevy3HLhUgQ. (for anyone looking for these --> Could you confirm these are the correct ones?)

Next step would be to flash the "h810_20n_UsU_bootloader_ARB2.zip" as mentioned in FAQ #20?
But wouldn't this cause an issue internally? As this bootloader is 20n (from experience 20 seems to mean MM), and my OS version is 10o (LP)?

I don't really care about the calling network.
It'd be nice to have it, but not really caring very much. I would use it as a wifi device only anyway.

Also, I took a backup as suggested. So when I flash them and something goes wrong, I can just re-flash the original partitions and be on my merry way? [confirm/deny]?

Thanks for your support! If I can do anything to help

 

[coder.toolbox]

Hello @steadfasterX,

Next step would be to flash the "h810_20n_UsU_bootloader_ARB2.zip" as mentioned in FAQ #20?
But wouldn't this cause an issue internally? As this bootloader is 20n (from experience 20 seems to mean MM), and my OS version is 10o (LP)?

Also, I took a backup as suggested. So when I flash them and something goes wrong, I can just re-flash the original partitions and be on my merry way? [confirm/deny]?

 

[steadfasterX]

But I also remember reading somewhere that you needed leaked qfil files to be able to use this method (correct?)?

well. you can create even your own ones. there is no specific vs986 "leak" needed for that but ofc a lot of knowledge. anyways I would say that you do not necessarily need them. I have created some for the vs968 a year ago but as I do not own that device I was unable to test it.
spoken of "leak": the programmer within the QFIL files is actually a leak but that's identical between ARB 0 devices and ARB higher then 0 devices share a different one.
as said they are not model specific (even when they are sometimes named liked that). most important is again the ARB of the programmer (yes ..even these programmers can trigger fuses and so making devices unusable).

Next step would be to flash the "h810_20n_UsU_bootloader_ARB2.zip" as mentioned in FAQ #20?
But wouldn't this cause an issue internally? As this bootloader is 20n (from experience 20 seems to mean MM), and my OS version is 10o (LP)?

no you flash a bootloader stack and will change the ROM after that anyways. you can have incompatibilities when your bootloader stack is too old but there is no issue the other way around, i.e. you can boot LP with a MM one.
btw: yes 20 means MM and 10 LP for this device. 30 would have been nougat (like it was released for the g4 f500). before u may ask v29 is a beta I can just highly recommend to NOT use the bootloader stack of that one. you could later flash the system as written in the FAQ if you need a pure stock one though

so the steps would be:

1. follow the complete guide to unlock by UsU (choose h810 files)
2. in TWRP flash the h810_20n_UsU_bootloader_ARB2.zip
3. reboot to TWRP
--> if it does not brick: hurray!
--> if it does: describe exactly what happens when you start the device (vibrate or not, just black screen etc), also share the output of the command "lsusb" while connected to mAid
4. flash the ROM of your choice

So when I flash them and something goes wrong, I can just re-flash the original partitions and be on my merry way? [confirm/deny]?

That backup is needed in several situations. often you just need a specific partition like the modem or the bootloader stack or parts of it.
Let's say you want to go back to pure STOCK LG then you (in your specific case) would flash a KDZ by LGup might be the easiest. The reason why you can do that is due to the fact that you have a fusing device (see FAQ #1).

other then that you could use also use an experimental mode in SALT to flash these partitions that way as well.
last but not least these files might be used to create a qfil recovery if ever needed.


.-

 

[Cyanoid]

My G4 is on v20j. Am I locked out of an unlocking?

I have a stock, unhacked/unlocked H812 model G4 on v20j firmware. System is MM v6.0 and ARB=0. The OP says nothing under v20x. But at the same time, that USU will unlock "ANY" G4!

Before I begin, I'd like to know if I'm going to brick my G4 because I am under v20x. Else, what will happen if I use mAid to USU a v20j G4? If I can't USU a v20j, can I maybe install a stock firmware that is v20x or above, using KDZ/TOT, and then proceed with USU unlock via mAid?