Scroll all the way down and read update section
Hello guys after I have been spending sometime trying out dlls for lgup, I have found a way to downgrade my V60 T-mobilefrom A11 back to A10. This is only tested on T-Mobile Variant ONLY, If you do do these steps for the verizon or any other for the downgrade, If within 48hours + you get a pop up of out of date or force update.
-LG mobile drivers(need it so it can detect your V60): https://www.lg.com/us/support/help-library/lg-mobile-drivers-and-software-CT10000027-20150179827560
-LG firmwares kdz from https://lg-firmwares.com/ (seem to have euro and tmobile kdz, limit 2 download per day)
http://lg-roms.com/LG-Firmware-List/LMV600VM for verizon
-Get the LG UP files from this website https://www.mylgphones.com/download-lg-up-software
-link to the adb where I got it https://androidmtk.com/download-minimal-adb-and-fastboot-tool
or you can use adb app control https://appcontrol.neocities.org/index_en.html
-Dial "*#*#244773825625#*#*" onto your dialar to check anti rollback
-LG's main hidden menu if you need it is "*#546368#*600#"
LG UP
1) youll need to download and install LG UP 1.16 [Original from LG] - No patched - lab version
-2) youll need the " LGUP Common DLL Ver 2.1" from the LG UP 1.17 folder and move it over to your LG UP folder where LG UP was installed then to "model" folder and then finally paste it into your "common" folder
-SET UP - I would highly advise removing sim card and not using wifi(so it wont use data to check software update during setup) after skipping the set ups etc. Also make sure to log out of your google accounts to remove the frp lock on fresh setup so you can skip.
STEPS
Note: in T-Mobile version 10w(possible) and 10x you will get google to notify you of out of date software and will eventually from day 1 - day 30 force update when your not using. I hope this time it works.
Everything involves risk so if you want to try these steps then go ahead but be cautious as Im not responsible for what happens.
1) download the TMO(tmobile) V600TM10S KDZ
2) Eject your sim and also remove you google accounts from device to remove frp. Leave it ejected as you dont want any data connection after flashing as youll need to skip everything and disable the adb packages.
3) Launch LG UP and select refurbish option(note you will lose all your data so Id do a backup of your files somewhere or to the cloud), select your kdz as well for the flash. If you get something from LG UP on NT code or something Id just cancel that pop up and reflash you desired KDZ twice to be safe after its first flash.
2) Skip through the LG and Google Set Ups and enable developer setting by going to Settings>System>About Phone>Software Info> and then just keep tapping build number until you unlocked the developer settings.
3) In developer settings: turn off automatic updates and enable USB Debugging for adb.
4)Use adb app control or adb commands to UNINSTALL (pm uninstall -k --user 0 xxx.xxx.xxx) these 5 packages:
com.lge.appbox.client
com.lge.updatecenter
com.google.android.apps.restore( I think this app can just be disabled since it has the disable button)
com.google.android.setupwizard.
com.google.android.apps.work.oobconfig(simply just because it says in the apps as device set-up)
5) This is optional but Id just do it for the heck of it otherwise just skip this step. Dial *#546368#*600#>Field Test>WIFI Test>OTA Setting>select and disable each core for each country code and exit.
6) Power Off and insert your sim card and power back on and connect to data services or wifi and enjoy
Tip: Band selection If you want your phone to only search/connect to those frequency bands: Dial "*#546368#*600#">Field Test>Modemn Settings>Band Selection.
Scores Benchmarks
-Geekbench 5.4 Android 10 - 925 single and 3400 multi
-Geekbench 5.4 Android 11 - 905 single and 3100 multi
Antutu v8.5.7-Android 10 555,407
CPU-183,322
GPU-209,203
MEM-86641
UX-76,241
Antutu v8.5.7-Android 11 548731
CPU-183,413
GPU-193,602
MEM-90,823
UX-80,893
UPDATE
-----The method doesnt or no longer works as OTA does come up or gets forced, There are 2 ways now is to disable/force stop/freeze google play services and services framework to stop google from forcing the t-mobile updates but you will risk breaking push notifications from apps. The other method will require root following an xda user @crimsonrommer post https://forum.xda-developers.com/t/v60-bootloader-unlock-and-magisk-root.4358785/ as rooting stops all ota updates from installing.
-----XDA will not let me delete this thread, mabey due to it working and not working as some wont get forced update and most will get forced.
--Please Delete this posts or ask me to re-edit if it violates or doesnt belong here.
Just to verify, this is the kdz you downloaded for U.S. TMO V60?
LG V600TM | LG V60 | Version: V600TM10x_00_TMO_US_OP_1103 | Firmware for Region: TMO from UNITED STATES - Lg-firmwares.com
LG V600TM Download the latest version of firmware | OS Version: Android 10 Q | Firmware version: V600TM10x_00_TMO_US_OP_1103 | TMO - Fan club LG-firmwares
lg-firmwares.com
Also when I dial that, it just disappears. No popups, no sound, nothing.
Not sure what went wrong with mine - but I ran the Refurbish option from LG UP 1.6. All seemed good except now the phone doesn't read my SIM or display an IMEI number. Dialing *#06# returns null and I get a nice message on the screen that says 'Service Disabled'
This is the file I tried out
LG V600TM | LG V60 | Version: V600TM10r_00_OPEN_CA_OP_0923 | Firmware for Region: CAN from - Lg-firmwares.com
LG V600TM Download the latest version of firmware | OS Version: Android 10 Q | Firmware version: V600TM10r_00_OPEN_CA_OP_0923 | CAN - Fan club LG-firmwares
lg-firmwares.com
Not sure if this is due to firmware mismatch or some bug in LG UP. Pretty sure the IMEI doesn't get wiped unless you run the ChipErase option.
Anyway - just leaving this here as a word of caution.
I'm also now looking for a way to fix this. Looking for any advise on how to proceed. I'm aware that discussing IMEI stuff on this forum is a bit iffy. I can prove I bought it and have the box with IMEI # stickers and all that. Seems most threads I read here that involve IMEI recovery have at least one accusation that the person stole the phone and is trying to get around a network blacklist.
Well I guess i'm a lucky sob.
I was thinking that my IMEI had been wiped and all was lost.
Turns out trying to downgrade the Canadian LGV600TM is just a no good very bad idea.
I used the KDZ Downloader to get Android 11 package and reinstalled it out of desperation and what do ya know - IMEI is read, cell service is back and my SIM card works. Guess i'll have to deal with the A11 bugs for now. Who needs MMS on wifi anywaaaay
The first clue my IMEI was still intact was when I used the three button combo (Power+Both Volume Keys) to display system info and my IMEI was still there.
Just glad I don't have an expensive brick!
One oddity is that the only lgup_common.dll that worked for me was the one you get from the 1.17 package (v2.1.0.23)
I tried versions 2.1.0.46 (from the A11 20f package) and 2.1.19 (from the A10 10r package) and neither would load in LGUP. Don't know what's magical about that one hosted on mylgphones but it's literally the only one I've found that works.
p.s.
The one lasting effect from my (mis)adventure is that my serial number now reads a very convincing 1234567890ABCD (probably got nuked after trying the PDM method in LGUP only to have that fail with getting stuck in blue factory reset 2 mode)
Anyway. I might try the A10 downgrade again but this time with a file from lg-roms (via KDZ Downloader).
Mumbles47 said:
One oddity is that the only lgup_common.dll that worked for me was the one you get from the 1.17 package (v2.1.0.23)
I tried versions 2.1.0.46 (from the A11 20f package) and 2.1.19 (from the A10 10r package) and neither would load in LGUP. Don't know what's magical about that one hosted on mylgphones but it's literally the only one I've found that works.
Click to expand...
Click to collapse
That dll file and LGUP 1.17 are actually originally found by me and are hosted here at xda too.
https://forum.xda-developers.com/posts/81856765/
That it works is just a coincidence. 19 seem to be used for Android 10 and 46 for 11. The 23 is there between. I guess that one has to play with these dlls, if doing some funny stuff like this...
GiftigDegen said:
Just to verify, this is the kdz you downloaded for U.S. TMO V60?
LG V600TM | LG V60 | Version: V600TM10x_00_TMO_US_OP_1103 | Firmware for Region: TMO from UNITED STATES - Lg-firmwares.com
LG V600TM Download the latest version of firmware | OS Version: Android 10 Q | Firmware version: V600TM10x_00_TMO_US_OP_1103 | TMO - Fan club LG-firmwares
lg-firmwares.com
Also when I dial that, it just disappears. No popups, no sound, nothing.
Click to expand...
Click to collapse
it should be fine ive only been on tmobile 20f first software to android 11 then reverted back to android 10 and yes correct
CXZa said:
That dll file and LGUP 1.17 are actually originally found by me and are hosted here at xda too.
https://forum.xda-developers.com/posts/81856765/
That it works is just a coincidence. 19 seem to be used for Android 10 and 46 for 11. The 23 is there between. I guess that one has to play with these dlls, if doing some funny stuff like this...
Click to expand...
Click to collapse
yeah it took alot of messing and trying out those dlls, got confused installed all these versions of lg up and tried all the common dlls and finally got it working. thanks man but the dll that i used from your 1.17 works for both A11 and A10
Also not the carrier brands as well like it will have "Can" next to it meaning canadian firmware. so flash the right one for your device or region
CXZa said:
That dll file and LGUP 1.17 are actually originally found by me and are hosted here at xda too.
https://forum.xda-developers.com/posts/81856765/
That it works is just a coincidence. 19 seem to be used for Android 10 and 46 for 11. The 23 is there between. I guess that one has to play with these dlls, if doing some funny stuff like this...
Click to expand...
Click to collapse
Whoa, it's the legend! There's definitely a few sites out there that don't give you much credit. Just wanted to say thanks for the tools you've created. Your blog and xda posts really saved me a lot of time downloading and figuring stuff out. The LGUP UI fixer is particularly cool revealing lots of fun options.
Random question, do you think it's possible to write back my serial number with the Script option? I've been looking for example files but no luck. Wondering if it's just an xml file with the extension renamed?
KouaV1 said:
yeah it took alot of messing and trying out those dlls, got confused installed all these versions of lg up and tried all the common dlls and finally got it working. thanks man but the dll that i used from your 1.17 works for both A11 and A10
Also not the carrier brands as well like it will have "Can" next to it meaning canadian firmware. so flash the right one for your device or region
Click to expand...
Click to collapse
I did happen to try installing the US version of the A10 V600TM firmware when I was looking for solutions to my broken A10 downgrade - LGUP 1.6 just spits out an error. The A10 file I had installed from lg-firmwares.com was marked as OPEN_CA. There might be some issue with that file. Haven't tried the Canadian A10 files from lg-roms yet.
I might just stick with A11 now however, found an old version of textra that has a MMS Wifi Fix option.
Mumbles47 said:
it's possible to write back my serial number
Click to expand...
Click to collapse
In that blue screen mode you could try this AT command...***
<function description="Manufacture SN Write" command="AT%MSN=" param="1234567890ABCD" status="0" response="NULL" delay="3"/>
Click to expand...
Click to collapse
My old device doesn't have this PDM option so I haven't been able to try it myself - yet...
Some quite new examples at hovatek...
How to use LGUP to write IMEI to LG Android
This guide will show you how to write IMEI to an LG Android device using LGUP. It'll come in handy in a case of null IMEI RequirementsDownload and install LG drivers Download the firmware for your mod
forum.hovatek.com
How to use LGUP to fix NVRAM Warning Err = 0x10 on LG
This guide will show you how to fix NVRAM WARNING Err = 0x10 an LG Android devices using LGUP. The trick is to write a valid WiFi MAC address RequirementsDownload and install LG drivers Download the f
forum.hovatek.com
edits, fixed typos: in bold
edit2:
this might be easiest way (the command might work in normal mode too) ??
*** reg query HKLM\hardware\devicemap\SERIALCOMM
echo AT%MSN=yourserialnumber>\\.\COM##
Mumbles47 said:
I did happen to try installing the US version of the A10 V600TM firmware when I was looking for solutions to my broken A10 downgrade - LGUP 1.6 just spits out an error. The A10 file I had installed from lg-firmwares.com was marked as OPEN_CA. There might be some issue with that file. Haven't tried the Canadian A10 files from lg-roms yet.
I might just stick with A11 now however, found an old version of textra that has a MMS Wifi Fix option.
Click to expand...
Click to collapse
open_ca thats "canada" kdz, if its t-mobile it will say "TMO".. Yeah you can try CXZa methods to try and write the IMEI. I like LG Up 1.16 of how it checks for antirollback with your current firmware and the current flashing firmware before attempting to flash but I just like to check antirollback with dialer just in case.
CXZa said:
In that blue screen mode you could try this AT command...***
this might be easiest way (the command might work in normal mode too) ??
*** reg query HKLM\hardware\devicemap\SERIALCOMM
echo AT%MSN=yourserialnumber>\\.\COM##
Click to expand...
Click to collapse
I'll admit i'm a bit scared to keep trying the PDM method as it would get stuck in factory reset 2 blue screen mode (there would be a timeout error near the end of the AT command process). The only way to get out of this mode was to run the Refurbish command again. Running the Upgrade command would run the install but then the phone would reboot right back into the blue screen again.
I did try that other command you listed. While the phone was booted normally.
Devicemap shows three devices
\Device\LGANDNETMDM0 REG_SZ COM6
\Device\LGANDNETDIAG1 REG_SZ COM4
\Device\LGANDNETDIAG21 REG_SZ COM7
I then tried running commands like
echo AT%MSN=L33TSERIAL4269>\\.\COM4
Then tried the same commands on ports 6 and 7. Didn't seem to have any effect.
I installed AT Command Tester and it was able to connect to COM6. However most commands error out. I can run things like AT+CGMM to get model#. Most other commands don't work even basic ones like AT+CIMI which should return my phone number.
Mumbles47 said:
reboot right back into the blue screen again
Click to expand...
Click to collapse
Did you try the AT%QEM=1 command?
(followed by AT%RESTART)
(Mentioned at LG Stylo 6 Development discord channel but it's now gone after rearranging... )
Thanks for the info
I can attest that this procedure does work for the Verizon variant also. You saved me a lot of head banging with this post. I was experiencing several annoying issues with Bluetooth on 11. Everything works fine with 10. My only problem now is that it downloads the new system files and gives me a nag screen to restart. I have tried deleting the cache in my system upgrade apps and have disabled auto updates in Dev options but I can't get rid of the nag screens. Any suggestions?
Thank you so much for providing this guide. I really appreciate it.
I kind of wish it was as simple as dropping the KDZ onto your phone and then the OS recognizing there's an update ready to go though. Just need to do an update, not a rollback.
Tonyhomebrewer said:
Thanks for the info
I can attest that this procedure does work for the Verizon variant also. You saved me a lot of head banging with this post. I was experiencing several annoying issues with Bluetooth on 11. Everything works fine with 10. My only problem now is that it downloads the new system files and gives me a nag screen to restart. I have tried deleting the cache in my system upgrade apps and have disabled auto updates in Dev options but I can't get rid of the nag screens. Any suggestions?
Click to expand...
Click to collapse
Where are you getting the Verizon image files to do this? LG-Firmwares.com looks like it only has the T-Mobile and unlocked international (EA) variants.
I also seem to have encountered some screens not documented in the OP's post. I couldn't even load LG UP to begin with, it would pop up with an error message (see below) and then only give me the option to close the dialogue box. ERROR:
LGUP can't load the model[C:\Program Files (x86)\LG Electronics\LGUP\model\com
Click to expand...
Click to collapse
SOLUTION: Extract the ZIP for the LG UP Tool 1.17 and run the LGUP_Cmd.exe first. THEN drop the DLL into place. Not sure what it was doing under the hood it was needed to be ran. I noticed that I didn't have the model folder present either and just dropping it into place without running the EXE was not working.
Advice on this!? I did some of my own research before asking.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
What is the NT code stand for? I found this page which makes it sound like it's used to identify part of the carrier identification: https://forum.hovatek.com/thread-38827.html
I used the REFURBISH option because I wanted a pure clean slate. When that thing popped up, I panicked a little and clicked cancel, thinking that would just revert the entire operation. NOPE! It just chugged ahead and did the whole thing. I should have copied that damn input code. Now I don't even have it. Is there any way to check what my current NT code is? Should I have skipped the download? Should I have written it back in? I really wish cancel actually CANCELLED THE OPERATION. I feel like I just maybe ruined my new phone.
My theory is that "Skip Download", if checked, would have just written a new NT Code and not flashed anything, so the refurbish process has 2 purposes.
onedges said:
Is there any way to check what my current NT code is? Should I have skipped the download? Should I have written it back in? I really wish cancel actually CANCELLED THE OPERATION. I feel like I just maybe ruined my new phone.
Click to expand...
Click to collapse
Do the flashing again? Or maybe this works??
AT command "AT%NTCODE?" should say it. Don't know if you have to go to the blue screen mode to do it. "AT%NTCODE=" is for writing it...
CXZa said:
Do the flashing again? Or maybe this works??
AT command "AT%NTCODE?" should say it. Don't know if you have to go to the blue screen mode to do it. "AT%NTCODE=" is for writing it...
Click to expand...
Click to collapse
I flashed it again shortly after posting (somehow the system update mechanism locked on to a new version and would eventually trigger a forced upgrade) but no NT code prompt. I also searched around using the "PHONESETTING" option but could not find anything. The next option would be to use a dev or hacked version of LG UP and try the PDM option, however it would not only just read NT code, but attempt another flash and try to write it.
Curious, where would I put that command in? ADB? I'm rather new to all of this. If anybody has the US T-Mobile version, try to capture the NT code and post it here.
Note for others too: after using LG UP to flash, my phone shows up as an "Unknown" model and only lets me launch LG UP for with in download mode first. Prior to this, you could launch LG UP with the phone fully booted and it would do the change over for you. Don't be freaked out.
CXZa said:
Mentioned at LG Stylo 6 Development discord channel but it's now gone after rearranging...
Click to expand...
Click to collapse
onedges said:
Curious, where would I put that command in?
Click to expand...
Click to collapse
I used putty.
Attached is one way to enter to the blue screen mode or whatever. Using an empty kdz file...
Spoiler: Some other AT commands
Code:
<?xml version="1.0"?>
<Testmode>
<!--LAFMID 진입 후 MID 파란화면 2 상태에서 단말의 정보를 저장 후 Reset -->
<function description="USB_SETTING" command="0-0-0" param="NULL" status="0" response="NULL" delay="3"/>
<function description="SP Factory Reset Flag Check" command="AT%FRSTSTATUS?" param="NULL" status="0" response="2" delay="3"/>
<function description="PID Write" command="AT%INFO=" param="P,1,2,3,4,5,6,7,8,9,0,A,B,C,D,E,F" status="0" response="NULL" delay="3"/>
<function description="IMEI Write" command="AT%IMEI=" param="1,2,3,4,5,6,7,8,9,0,1,2,3,4,7" status="0" response="NULL" delay="3"/>
<function description="BTAD Write" command="AT%BTAD=" param="1,2,3,4,5,6,7,8,9,0,A,B" status="0" response="NULL" delay="3"/>
<function description="WIFI MAC Address Write" command="AT%MAC=" param="1,2,3,4,5,6,7,8,9,0,A,B" status="0" response="NULL" delay="3"/>
<function description="Manufacture SN Write" command="AT%MSN=" param="1234567890ABCD" status="0" response="NULL" delay="3"/>
<function description="Manufacture Date Write" command="AT%MDATE=" param="2000/01/01" status="0" response="NULL" delay="3"/>
<function description="Suffix Code Write" command="AT%SUFFIX=" param="X5-LG.ASBMBK" status="0" response="NULL" delay="3"/>
<function description="NT Code Write" command="AT%NTCODE=" param="NULL" status="0" response="NULL" delay="3"/>
<function description="Mode Reset" command="AT%RESTART" param="NULL" status="0" response="RESTARTING SYSTEM" delay="3"/>
<!--MID2 진입 후 Info check 진행 -->
<function description="SLEEP" command="0-0-0" param="NULL" status="0" response="NULL" delay="50"/>
<function description="USB_SETTING" command="0-0-0" param="NULL" status="0" response="NULL" delay="3"/>
<function description="Boot Complete Check" command="AT%FBOOT" param="NULL" status="0" response="1" delay="3"/>
<function description="PID Read" command="AT%INFO" param="NULL" status="0" response="P1234567890ABCDEF" delay="3"/>
<function description="IMEI Read" command="AT%IMEI?" param="NULL" status="0" response="123456789012347" delay="3"/>
<function description="HW Version Read" command="AT%HWVER" param="NULL" status="0" response="STRING" delay="3"/>
<function description="BTAD Read" command="AT%BTAD" param="NULL" status="0" response="1234567890AB" delay="3"/>
<function description="WIFI MAC Address Read" command="AT%MAC" param="NULL" status="0" response="1234567890AB" delay="3"/>
<function description="Manufacture SN Read" command="AT%MSN" param="NULL" status="0" response="1234567890ABCD" delay="3"/>
<function description="Manufacture Date Read" command="AT%MDATE" param="NULL" status="0" response="2000/01/01" delay="3"/>
<function description="Suffix Code Read" command="AT%SUFFIX?" param="NULL" status="0" response="X5-LG.ASBMBK" delay="3"/>
<function description="OS Version Read" command="AT%OSVER" param="NULL" status="0" response="STRING" delay="3"/>
<function description="External Socket Memory Check" command="AT%EMT" param="NULL" status="0" response="STRING" delay="3"/>
<function description="Device ID Read" command="AT%DEVICEID" param="NULL" status="0" response="STRING" delay="3"/>
<function description="USIM Card Test Result" command="AT%ISSIM" param="NULL" status="0" response="STRING" delay="3"/>
<function description="AAT Result Check" command="AT%DEVICETEST" param="NULL" status="0" response="STRING" delay="3"/>
<function description="CAL Data Check" command="AT%CALDT" param="NULL" status="0" response="STRING" delay="3"/>
<function description="QFUSE Check" command="AT%EFUSECHECK" param="NULL" status="0" response="STRING" delay="3"/>
<function description="Battery Level" command="AT%BATTLEVEL" param="NULL" status="0" response="STRING" delay="3"/>
<function description="RAM Memory Size" command="AT%RAMSIZE" param="NULL" status="0" response="STRING" delay="3"/>
<function description="Internal Flash Memory Size" command="AT%EMMCSIZE" param="NULL" status="0" response="STRING" delay="3"/>
<function description="Manual Mode Status Check" command="AT%QEM?" param="NULL" status="0" response="0" delay="3"/>
<function description="NT Code Read" command="AT%NTCODE?" param="NULL" status="0" response="STRING" delay="3"/>
<function description="HW Component Information" command="AT%HWCOMPONENTINFO" param="NULL" status="0" response="STRING" delay="3"/>
<!--function description="Unlock Code Verify" command="250-036-003" param="NULL" status="1" response="NULL" delay="3"/-->
<function description="SIM Lock Type Status Check" command="AT%SLTYPE?" param="NULL" status="0" response="STRING" delay="3"/>
<function description="Full Signature Status Check" command="AT%FUSG?" param="NULL" status="0" response="STRING" delay="3"/>
<function description="IMPL Status" command="AT%IMPL?" param="NULL" status="0" response="STRING" delay="3"/>
<function description="SIM ID Read" command="AT%SIMID" param="NULL" status="0" response="STRING" delay="3"/>
<function description="File CRC Check" command="AT%FILECRC" param="NULL" status="0" response="STRING" delay="10"/>
<!-- Factory Reset status 3 및 MID 2공정 Command List -->
<function description="SP Factory Reset Cold Boot" command="AT%FRSTSTATUS=3" param="NULL" status="0" response="FRST STATUS SET OK" delay="10"/>
<function description="SP Factory Reset Flag Check" command="AT%FRSTSTATUS?" param="NULL" status="0" response="3" delay="5"/>
<function description="Work Factory reset Mode On" command="AT%WORKFRSTMODEON" param="NULL" status="0" response="WORKFRSTMODEON OK" delay="3"/>
<function description="Power reset" command="AT%RESTART" param="NULL" status="0" response="RESTARTING SYSTEM" delay="3"/>
<function description="SLEEP" command="0-0-0" param="NULL" status="0" response="NULL" delay="200"/>
<function description="USB_SETTING" command="0-0-0" param="NULL" status="0" response="NULL" delay="3"/>
<function description="Setup Wizard Check" command="AT%FRSTSTATUS?" param="NULL" status="0" response="5" delay="5"/>
<function description="Input SW Version" command="AT%SWOV" param="NULL" status="0" response="STRING" delay="10"/>
<function description="Output SW Version" command="AT%SWV" param="NULL" status="0" response="STRING" delay="10"/>
<function description="SW Fixed Area Version" command="AT%SWFV" param="NULL" status="0" response="STRING" delay="10"/>
<function description="DB CRC Check" command="AT%DBCHK" param="NULL" status="0" response="STRING" delay="10"/>
<function description="FPRI CRC Check" command="AT%FPRICRC" param="NULL" status="0" response="STRING" delay="10"/>
<function description="File CRC Check" command="AT%FILECRC" param="NULL" status="0" response="STRING" delay="10"/>
<function description="Power Off" command="AT%POWEROFF" param="NULL" status="0" response="NULL" delay="10"/>
</Testmode>
(that might work - or not)
onedges said:
I flashed it again shortly after posting (somehow the system update mechanism locked on to a new version and would eventually trigger a forced upgrade) but no NT code prompt. I also searched around using the "PHONESETTING" option but could not find anything. The next option would be to use a dev or hacked version of LG UP and try the PDM option, however it would not only just read NT code, but attempt another flash and try to write it.
Curious, where would I put that command in? ADB? I'm rather new to all of this. If anybody has the US T-Mobile version, try to capture the NT code and post it here.
Note for others too: after using LG UP to flash, my phone shows up as an "Unknown" model and only lets me launch LG UP for with in download mode first. Prior to this, you could launch LG UP with the phone fully booted and it would do the change over for you. Don't be freaked out.
Click to expand...
Click to collapse
you can try patched version 1.14 see if it has pdm option or try all those hacked, patched versions. I had this issue with my LG G4 once and flashed the tot and it fixed it.
Related
So, I did some digging and I found a list of codes for LG...
To check LG mobile or cellphones IMEI (International Mobile Equipment Identity)
On the main screen type *#06#
Information you get from the IMEI (International Mobile Equipment Identity)
XXXXXX XX XXXXXX X
TAC FAC SNR SP
TAC = Type approval code of your LG Mobile
FAC = Final assembly code of your cellphone
SNR = Serial number of your LG Phone
SP = Spare
Other secret tricks for LG mobile or cellphone
LG all models test mode:
Type 2945#*# on the main screen.
2945*#01*# Secret menu for LG
IMEI and SW (LG 510): *#07#
Software version (LG B1200): *8375#
Recount cheksum (LG B1200): *6861#
Factory test (B1200): #PWR 668
Simlock menu (LG B1200): 1945#*5101#
Simlock menu (LG 510W, 5200): 2945#*5101#
Simlock menu (LG 7020, 7010): 2945#*70001#
Simlock menu (LG 500, 600): 2947#*
LG-U81XX SPECIAL CODES
Code to read phone version :
- Phone without SIM
- Enter 277634#*# or 47328545454#
- Select 'SW Ver.info'
Code to reset phone :
- Phone without SIM
- Enter 277634#*# or 47328545454#
- Select 'Factory Reset'
Code to enter UNLOCK MENU :
- Phone wit SIM inside
- Enter 2945#*88110#
Test Menu 8330 : 637664#*#
Test Menu 8180 V10a: 49857465454#
Test Menu 8180 V11a: 492662464663#
Test Menu 8130-8138: 47328545454#
Test Menu 8110-8120: 277634#*
The only problem is, any code I try fails. I get USSD Code Running....
then I get the message MMI code Cancelled.
Anyone run into this before? This worked before I rooted and applied Pauls pre-dexopt tweek.
You may miss the sticky.
Try
2945#*999#
Izzydroolin said:
So, I did some digging and I found a list of codes for LG...
To check LG mobile or cellphones IMEI (International Mobile Equipment Identity)
On the main screen type *#06#
Information you get from the IMEI (International Mobile Equipment Identity)
XXXXXX XX XXXXXX X
TAC FAC SNR SP
TAC = Type approval code of your LG Mobile
FAC = Final assembly code of your cellphone
SNR = Serial number of your LG Phone
SP = Spare
Other secret tricks for LG mobile or cellphone
LG all models test mode:
Type 2945#*# on the main screen.
2945*#01*# Secret menu for LG
IMEI and SW (LG 510): *#07#
Software version (LG B1200): *8375#
Recount cheksum (LG B1200): *6861#
Factory test (B1200): #PWR 668
Simlock menu (LG B1200): 1945#*5101#
Simlock menu (LG 510W, 5200): 2945#*5101#
Simlock menu (LG 7020, 7010): 2945#*70001#
Simlock menu (LG 500, 600): 2947#*
LG-U81XX SPECIAL CODES
Code to read phone version :
- Phone without SIM
- Enter 277634#*# or 47328545454#
- Select 'SW Ver.info'
Code to reset phone :
- Phone without SIM
- Enter 277634#*# or 47328545454#
- Select 'Factory Reset'
Code to enter UNLOCK MENU :
- Phone wit SIM inside
- Enter 2945#*88110#
Test Menu 8330 : 637664#*#
Test Menu 8180 V10a: 49857465454#
Test Menu 8180 V11a: 492662464663#
Test Menu 8130-8138: 47328545454#
Test Menu 8110-8120: 277634#*
The only problem is, any code I try fails. I get USSD Code Running....
then I get the message MMI code Cancelled.
Anyone run into this before? This worked before I rooted and applied Pauls pre-dexopt tweek.
Click to expand...
Click to collapse
Thanks mingkee, but I'm not trying to unlock the phone, I'm just trying to get to the secret menu. Still no go.
The standard secret menu? *#*#4636#*#*
Izzydroolin said:
Thanks mingkee, but I'm not trying to unlock the phone, I'm just trying to get to the secret menu. Still no go.
Click to expand...
Click to collapse
Get "anycut" from market.
I have a Photon Q updated to the latest Jelly Bean. It is rooted. Currently when I press the caps lock key, it does not apply itself to the number keys. Is there an app to do this? Is there a keyboard map file I could download to achieve that? I could edit myself and don't mind following directions... Any other ideas?
You can edit the file "keypad_8960.kcm" in folder "/system/usr/keychars/".
You find the line "key 0 { ..." and you change "shift: ')' " to "shift, capslock: ')' ".
EDIT: FIXED. I flashed persist.img from version "S250260_210804..." (unzip, flash via `fastboot flash persist persist.img`) https://mirrors.lolinet.com/firmware/lenovo/Tab_P11_Pro/TB-J706F/
Hello dear community,
I am in need of some help. So here is what I did:
* Coming from latest Android 11 ROW, flashed ZUI using QFIL from here: https://mirrors.lolinet.com/firmware/lenovo/Tab_P11_Pro/TB-J706F/
* tried upgrading to ZUI 12.5, 12.6 and 13 but didn't work
* used fastboot to unlock and unlock_critical (i know, i know...)
* used payload_dumper (from some github repo) to extract zui 13 update.zip
* flashed every image I extracted manually using fastboot (I know, I'm stupid)
* Got ZUI 12.0 working, didn't like it and wanted ROW android 11 back
* flashed latest ROW rom using QFIL from lolinet url -> bootloop
* flashed oldest ROW rom using QFIL, updated 3x via OTA to latest version -> few bootloops, then device booted back to android 10 and created notification "failed to install ota"
So I can install any version between TB-J706F_S210002_201015_ROW and TB-J706F_S250260_210804_ROW from lolinet url, but nothing above that. Neither through QFIL, nor using lenovo smart rescue assistent, nor using OTA update from android 10 (which is working fine).
I tried following things to fix this:
* ####6030# -> change to CN and change the NV value to 00
* ####6030# -> change to DE and change the NV value to 02 or 00
* flash latest ROW using QFIL, then change NV value from 02 to 00
nothing of that worked and I'm starting to believe, that I ****ed up some partitions using fastboot. Because I flashed images from ZUI android 11 and I can't install ROW android 11 now.
Could I possibly try restoring a TWRP backup from some other user?
What else could I do to install android 11?
PS: I used QFIL backup and restore tool to change the NV value. Because the nv reader/writer tool didn't seem to work.
It might help, if someone would be kind enough to provide me with the following images (by backing them up with twrp):
* abl
* xbl_a
* xbl_b
Hi there, I also got into this trouble that can't flash any global ROM including TB-J706F_S250260_210804_ROW. What I did is change the NV value to 02 and not 00 using QFIL. After that I was able to update via OTA and currently on the latest global ROM.
Thanks to this thread: https://forum.xda-developers.com/t/check-region-unlock-p11-tb-j606f-l-n.4356451/
MateUserHHTTI have similar problem before, can not flash to Android 11, even ROW or ZUI, bootloop~
please check your J706F screen auto rotate and auto brightness(and pair bluetooth devices) still functional?
If not functional, I'm following below post instruction to flash presist.img, and can upgrade to Android 11, both of ROW & ZUI are available.
<TB-J706F> Auto-rotation & Auto Brightness Broken.But Serial Number shows 123456789ABCDEF, wifi /bluetooth MAC shows 00:00:00... still not solve even functional.
auston said:
But Serial Number shows 123456789ABCDEF, wifi /bluetooth MAC shows 00:00:00... still not solve even functional.
Click to expand...
Click to collapse
I may found a fix for Bluetooth MAC by generating a file for the "NV-items_reader_writer.exe" and wrote it to NV item 447 (some one sait this is BT). Problem was that this item (447) was NOT present at this time inn QCN.
WARNING! May my guess of "Items size" 128 is wrong, I don't know. Use at your own risk and change the file to your MAC.
After that I flashed "persist.img" (matching the actual ROM), some one wrote that this fixed the autorotate. I can confirm this.
But still not found solution for serial, the correct serial is still in NV item 2497.
Okay, Serial number restore can be done the same way.
See here https://forum.xda-developers.com/t/tab-j706f-serial-number.4318901/
Best would be to have the full original QCN file (or an editor for this files)
MateUserHHTT said:
* abl
* xbl_a
* xbl_b
Click to expand...
Click to collapse
abl (_a and _b) = abl.elf
xbl (_a and _b) = xbl.elf
You will find both in the ROM Zip's at lolinet.
Mine updates successfully from 10 to 11 after I have restored BT, Wifi, SN, PN and region lock. And flashed persist.img.
Oh, and you have to set region code in QCN NV 6858, somebody found out that Android 11 checks that value. If it is wrong, device boot loops.
auston said:
please check your J706F screen auto rotate and auto brightness(and pair bluetooth devices) still functional?
Click to expand...
Click to collapse
Firstly, let me thank you for your reply! It's interesting, I indeed noticed just a few days ago, that auto rotation isn't working!
I will follow the guide you linked and update my post accordingly.
Edit: THANK you very much indeed! My problem was solved instantly by this!
Flashed persist.img via fastboot, flashed the latest ROM from lolinet using QFIL and had no issues whatsoever.
Oh, and you have to set region code in QCN NV 6858, somebody found out that Android 11 checks that value. If it is wrong, device boot loops.
Click to expand...
Click to collapse
as I said in my post, I did tried both 00 and 02. I read the thread about the second region code checking.
CryptMan said:
Mine updates successfully from 10 to 11 after I have restored BT, Wifi, SN, PN and region lock. And flashed persist.img.
Click to expand...
Click to collapse
I don't have any problem but just in case...
I guess PN is Product Number where did you change it and where do you get the correct value? I only found a code before the SN that looks unique per tablet but it's not in the box.
MrCrayon said:
I guess PN is Product Number where did you change it and where do you get the correct value?
Click to expand...
Click to collapse
Well I changed the PN in NV item 2497
I found this PN number here: https://forum.xda-developers.com/t/tab-j706f-serial-number.4318901/#post-86315607
My other device, P11 (TB-J606F), has this number: 8SSP69A6PB5XHA6213L0864
Because they look pretty same (length, etc.) I decided to try it.
May somebody would confirm if this PN are the same on all device.
Open settings and type in the search bar "####2222#". That will display PN and SN.
One issue persists though, which is that my widewine level is set to L3.
1. I flashed persist.img from TB-J706F_S250260_210804_ROW
2. I then installed the TB-J706F_S620150_211226_ROW via QFIL and
3. updated to TB-J706F_S630185_220128_ROW via OTA in system settings.
My serial number is also 1-9A-F. My device is locked. I'm unlocking my device and flashing the persist.img of the latest ROM. If that doesn't work, what are my options to restore L1?
CryptMan said:
Well I changed the PN in NV item 2497
I found this PN number here: https://forum.xda-developers.com/t/tab-j706f-serial-number.4318901/#post-86315607
My other device, P11 (TB-J606F), has this number: 8SSP69A6PB5XHA6213L0864
Because they look pretty same (length, etc.) I decided to try it.
May somebody would confirm if this PN are the same on all device.
Open settings and type in the search bar "####2222#". That will display PN and SN.
Click to expand...
Click to collapse
Ah ok, so the number before SN is the PN.
I have two J706F and they have different PN, The last 8-9 digits are different and the other ones are the same.
I could not find that code anywhere else.
MateUserHHTT said:
One issue persists though, which is that my widewine level is set to L3.
Click to expand...
Click to collapse
If you check in play store settings does it say your device is certified?
On my J706F, the one on which I have lost QCN with SN MAC etc. , I have the same problem as MateUserHHTT.
The device lost L1 cert. PlayStore says NOT certified and "DRM Info" app says L3.
I also have a property "sys.lenovo.widevine_security_level" with value "L3".
My guess it that there is a file or partition holding this certifications, but I don' t know which.
And of course I don't have a backup ...
If you check in play store settings does it say your device is certified?
Click to expand...
Click to collapse
It says "Device is not certified"
Now that's curious: my tablet, running the latest Android 11 ROW version, is offering me to upgrade my device to Android Kitkat 4.4. Now that's an offer I can't resist (yes, of course I clicked "update". I want all the new features!)
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
CryptMan said:
The device lost L1 cert. PlayStore says NOT certified and "DRM Info" app says L3.
I also have a property "sys.lenovo.widevine_security_level" with value "L3".
Click to expand...
Click to collapse
Is your bootloader unlocked or did you unlock it previously and relocked?
MateUserHHTT said:
It says "Device is not certified"
Now that's curious: my tablet, running the latest Android 11 ROW version, is offering me to upgrade my device to Android Kitkat 4.4. Now that's an offer I can't resist (yes, of course I clicked "update". I want all the new features!)
Click to expand...
Click to collapse
Maybe the OTA app is getting some wrong data / not set data and that's the result
I tried to decompile that app to get the address called to download updates but my knowledge of android programming is really basic and did not have enough time.
MrCrayon said:
Is your bootloader unlocked or did you unlock it previously and relocked?
Maybe the OTA app is getting some wrong data / not set data and that's the result
I tried to decompile that app to get the address called to download updates but my knowledge of android programming is really basic and did not have enough time.
Click to expand...
Click to collapse
I previousl, unlocked and afterwards relocked it (both flashing lock and flashing lock_critical)
Yes, I once said "erase all before download" and accidentally deleted my original qcn file so some NV fields seem to be missing. Maybe that caused the app to default back to 4.4 it was Lenovo Feature Updater by the way, not the settings - system - update.
If you share your past work in a git repo I will take a look at it. I'm no expert for sure but I'm developing fir android for some years and have stuck my nose a tiny bit under the surface of android rom development (1mm and it was very painful still).
My widewine lvl is L3. Any chance of resetting to L1 myself? I don't know much about how trust attestation works. :/
MateUserHHTT said:
It was Lenovo Feature Updater by the way, not the settings - system - update.
Click to expand...
Click to collapse
I disabled that as soon as I saw it
MateUserHHTT said:
If you share your past work in a git repo I will take a look at it. I'm no expert for sure but I'm developing fir android for some years and have stuck my nose a tiny bit under the surface of android rom development (1mm and it was very painful still).
Click to expand...
Click to collapse
Not much really, I'm not at my desk now but I extracted LenovoOTA from stock ROM and decompiled it with apktools, but even with online tools is probably ok.
Then I see two options:
Recompile that package changing package name and adding a log with full address and parameters or get the code that construct the URL and put it in a new app.
For you probably the last one is easier.
I went for a third I was trying to understand if i could get the data with adb or in files but I did not find documentation.
MateUserHHTT said:
My widewine lvl is L3. Any chance of resetting to L1 myself? I don't know much about how trust attestation works. :/
Click to expand...
Click to collapse
I don't think there is a way to force it, this widevine a thing is a pain.
MrCrayon said:
Is your bootloader unlocked or did you unlock it previously and relocked?
Click to expand...
Click to collapse
Locked, and was never unlocked before.
I tried to unlock now, but does not succeed with flashing sn.img.
Because I'm not interested on Custum ROM, I will leave it locked.
Do you know where the device certification is stored?
I unlocked without flashing sn.img. Does that make a difference?
Did you try monitoring the network traffic with wireshark?
Hi everybody,
I may need the help of someone very experimented in flashing smartphones with Mediatek chipsets,
I wanted to unlock the bootloader of my K52, so I downgraded it to Android 10, then I unlocked it with MTKClient, but it got stuck in a bootloop,
Then, searching how to wipe userdata, I accidentally erased all partitions on the phone,
Now it won't boot anymore, I just can download it in BROM mode, with the "python mtk payload" command,
I've tried this guide, the k52 has exactly the same chipset, but with no chance,
Could anyone help me plz ?
I'd be very grateful ! :3
have install twrp?
arfooux said:
have install twrp?
Click to expand...
Click to collapse
what part of 'wiped my whole flash' do you not understand?
also I'm quite sure you are screwed, speaking from personal experiance, as there are some partitions that just don't come with a stock ROM because they're for calibration and other purposes (I can't say what exactly, but things like the modem drivers to comply with regional authority and some such is a good bet)
so really you'd need a full mtkclient flash dump from a good L52 to then flash onto your bricked one
P.S. my experiance being that even though I've flashed a stock rom to my X626B after a whole flash wipe I only get a bootloop and haven't been able to diagnose the problem on account nobody knows how to get a UART console without a bridge despite not needing one...
Hello,
Thanks for answering,
I have spent hours searching on the web different possible solutions to bring my phone back to life, and here is my progress so far :
- I've been able to extract from a stock ROM KDZ file the following partitions :
- boot : boot.img_1064960 and boot.img_1540096, I don't know if they are boot_a or boot_b, they look pretty similar on hex editor, stripped like .bin dump from ROM, and when I make a Get-FileHash on both with powershell I have exactly the same result (and it's applicable to all files with same name)
- dtbo
- efuse
- ftm
- laf
- lk
- logo
- md1img
- OP_COM1_EU (3 different files, and the third neigher has the same size nor the same contents in hex editor as the other ones, so I guess a and b??)
- preloader
- patched_pgpt
- patched_sgpt
- rct
- scp
- spmfw
- sspm
- super (a lot of files with different sizes)
- tee
- userdata (a lot of files with different sizes)
- vbmeta_COM1_EU
I guess they are in the right format when I compare in hex editor the preloader file I extracted with a *.bin I have found I don't remember where they are the same
- I've managed to generate a scatter file from patched_pgpt with WWR
- I've connected my phone and used bypass_utility (https://github.com/MTK-bypass/bypass_utility) flashed partitions using scatter file with SP Flash Tool (https://spflashtool.com/)
- Now, when I open mtk_gui (https://github.com/bkerler/mtkclient), the tabs read/write/erase partitions are not empty anymore, here is what I have
- boot_para
- proinfo
- para
- efuse
- spare1
- nvcfg
- nvdata
- metadata
- misc2
- ftm
- mt_udc
- expdb
- frp
- protect1
- protect2
- seccfg
- nvram
- persist
- persist_lg
- p_persist_lg
- md1img_a
- spmfw_a
- scp_a
- sspm_a
- lk_a
- tee_a
- spare2
- logo_a
- dtbo_a
- vbmeta_a
- vbmeta_system_a
- vbmeta_vendor_a
- boot_a
- laf_a
- md1img_b
- spmfw_b
- scp_b
- sspm_b
- lk_b
- tee_b
- spare3
- logo_b
- laf_b
- eksst
- encrypt
- rct
- spare4
- power
- mpt
- fota
- els
- carrier
- srtc
- operatorlogging
- super
- OP_a
- OP_b
- userdata
- flashinfo
It pretty looks like what I had before I get stupid enough to erase everything, so I guess I progressed in the right way
Anyway, the phone still doesn't start
I can't get to download mode, fastboot mode, etc
Whe I do python mtk plstage --preloader=preloader_muse6765_64_eh35_q.bin, Windows detects LGE Mobile USB Serial Port on device manager, then disappears after a few seconds and becomes MediaTek USB Port, and loops like this
So I guess something is missing
My question is
Which partitions do I need to flash to at least get Download Mode back ? So that I can use LG software and flash KDZ
I'll keep searching, but if anyone has information, or why not a full ROM dump, I'd be glad
Best regards,
François
Just to give some updates, I've tried another tool to extract the KDZ file : https://gist.github.com/iscgar/e0da0868df7b2f179b000c61f12d1a8c
Now I have clearly named files : 0.boot_a.img, 0.boot_b.img, etc.
So, I'm manually flashing partitions. Each partition is mentioned in the generated scatter file by WWR as on this example :
- partition_index: SYS22
partition_name: md1img_a
file_name: md1img.img
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x17000000
physical_start_addr: 0x17000000
partition_size: 0x6000000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
is_upgradable: true
empty_boot_needed: false
reserve: 0x00
So, for each one that has a .img file, im doing this
python mtk wo 0x17000000 0x6000000 0.md1img_a.img
with 0x17000000 being the line physical_start_addr and 0x6000000 the line partition_size
all partitions are not in the directory, seccfg, fota, frp, are missing, so, well, we'll see what happens
So far, I have flashed boot_a, boot_b, laf_a, laf_b, lk_a, lk_b, logo_a, logo_b, md1img_a, md1img_b, ssmp_a, ssmp_b, spmfw_a, spmfw_b, rct, tee_a, tee_b, dtbo_a, dtbo_b, efuse, vbmeta_a, vbmeta_b, pgpt, sgpt
I'm not sure about what I have done with OP, I flashed 0.OP_S.img in the OP_a partition
Anyway, so far, I've tried
power : nothing
power + vol up : nothing
power + vol down : nothing
power + both vol buttons : nothing
But, python mtk plstage --preloader=preloader_muse6765_64_eh35_q.bin as usual, LGE device appears for a few seconds on the device manager, and something more, the phone displays the LG K52 boot screen for a few seconds, then turns back off,
Not great yet, the phone is still not usable, but it's encouraging !
I'll keep you informed !
Nothing else than this yet, but satisfying to see progress, I wanted to share this with you
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
I just copied super partition, now when I push power button, it vibrates, displays the LG K52 boot screen, and displays "All Slots are unbootable" in red
I can get neither download mode nor fastboot, but I'm confident I'm getting close to get it working again !
Well, I tried to flash everything again, and now the phone is dead again, no more vibration and no more logo...
I noticed it was possible to communicate with the BROM with a UART interface at a baudrate of 115200, 8 bits, 1 stop bit, no parity and no flow control, I found a document yesterday explaining that a few commands could be called like 'Version', 'Start', 'Jump', but nothing happens when I try with PuTTY,
If somebody can help I'd be very glad !
Okay, after idk how many attemts, I managed to have the phone powerong on again after flashing with SP Flash Tool
buuuuuuut
Something more !!
Now, it doesn't only bootloop when the BL is unllocked, it also displays a message I didn't have at the first time I could power it on again !
I haven't progressed more so far, may anyone have a suggestion ?
I've tried :
- reflashing everything
- removing AVB header in the boot partition img to disable verified boot just in case it would change something (replacing the 256 bytes of the header of AVB in HxD with zeroes)
- the whole process from KDZ to manually reflash partitions with another stock ROM to see if it changes something
- erasing userdata, md_udc and metadata
- python mtk payload --metamode FASTBOOT => won't boot in fastboot
I'm now out of ideas...
It keeps displaying in a bootloop the LG logo, then either "all slots are unbootable" or "Your device cannot be checked for corruption. Lock the bootloader"
All I think I know, is that to reach that far in the startup process, it means we're in the LittleKernel (AM I RIGHT PLEASE CAN ANYONE CONFIRM ? ), and I may have something interesting if I manage to build a custom one with debug symbols, but no source code related to MT6765 anywhere on the internet, I guess I'm kinda stuck...
And at the same time, just to try, I build a custom LK with ARM target from the github source code, it generates a LK and a LK.img, but in Hxd, the first bytes are very very very different, the one from my LG stock ROM starts with IDK how many rows ful of "0xFF" bytes, the built one doesn't..
Does anyone have an idea of what I may want do to find what's wrong with the boot process of my phone ?
Up ?
Maybe I can help you solve this problem, because I use the same mobile phone as you. But after repairing the boot, your phone may lose the serial number, so far, I do not know how to repair the serial number. If I have time, I'll look into it
When I turn it on now, if I push simultaneously PWR, VOL+ and VOL- buttons barcodes with S/N, IMEI and manufacturing dates, and all is zero,
Honestly, I don't mind if I don't have the S/N anymore, I know all the numbers have been wiped out, now event the IMEI consist of zeroes, I've called Orange customer service so they told me the IMEI of the terminal I used with my SIM card between feb 2021 and mar 2023 so I'm gonna have to find a way to reinject it but it's okay I'll find a way, I don't know how yet but, if at least, I can get it starting again I'd already be more than happy
Hi, i'm trying to understand how does BlueStacks Tweaker 5.16.1 change the GUID in the background so i can do it manually, it seems that it's modifying the following registry values but these values keep reverting maybe i'm missing something:
Code:
[HKEY_LOCAL_MACHINE\SOFTWARE\BlueStacks_bgp_kk\Config]
"IsIncludeMachineGUID"=dword:00000001
"SYSTEM_GUID"="00000000-0000-0000-000000000000"
Can someone please explain what does the patch button for the GUID do in the background ?
Why not ask developer of BlueStacks Tweaker 5.16.1 ( Anatoly Jacobs ) this question?
Here you'ld go:
BlueStacks Tweaker 6. Tool for modifing BlueStacks 2 & 3 & 3N & 4 & 5
BlueStacks Tweaker 6. Tool for modifing BlueStacks 2 & 3 & 3N & 4 & 5 Root for BlueStacks 5 Hyper-V Video Manuals: How to Root BlueStacks 4, install SuperSU 2.82-SR5 and update su binary (BSTweaker 6) How to install Magisk on BlueStacks 5...
forum.xda-developers.com
@THE GUID is getting changed to change the Android ID? Android devices have only a Google advertising ID (GAID or AAID for Android Ad ID). This ID can be disabled/new created in settings menu > Google > Advertising.
With root you can also fake/delete the ID by editing /data/data/com.google.android.gms/shared_prefs/adid_settings.xml.
Since Android 8 an unique Android ID for your device is no longer created. Instead of this every single app creates an own Android ID. You can test it with multiple Android ID reader apps that will all give you different Android IDs.
WoKoschekk said:
...
Since Android 8 an unique Android ID for your device is no longer created. Instead of this every single app creates an own Android ID. You can test it with multiple Android ID reader apps that will all give you different Android IDs.
Click to expand...
Click to collapse
The Bluestacks version mentioned by OP is based on 32-bit Android 4.4
jwoegerbauer said:
Why not ask developer of BlueStacks Tweaker 5.16.1 ( Anatoly Jacobs ) this question?
Here you'ld go:
BlueStacks Tweaker 6. Tool for modifing BlueStacks 2 & 3 & 3N & 4 & 5
BlueStacks Tweaker 6. Tool for modifing BlueStacks 2 & 3 & 3N & 4 & 5 Root for BlueStacks 5 Hyper-V Video Manuals: How to Root BlueStacks 4, install SuperSU 2.82-SR5 and update su binary (BSTweaker 6) How to install Magisk on BlueStacks 5...
forum.xda-developers.com
Click to expand...
Click to collapse
Already did but it's unlikely that he'll answer.
WoKoschekk said:
@THE GUID is getting changed to change the Android ID? Android devices have only a Google advertising ID (GAID or AAID for Android Ad ID). This ID can be disabled/new created in settings menu > Google > Advertising.
With root you can also fake/delete the ID by editing /data/data/com.google.android.gms/shared_prefs/adid_settings.xml.
Since Android 8 an unique Android ID for your device is no longer created. Instead of this every single app creates an own Android ID. You can test it with multiple Android ID reader apps that will all give you different Android IDs.
Click to expand...
Click to collapse
The GUID is for BlueStacks not to be confused with Android, it controls the IMEI, the Android ID and the WiFi Mac, the change to the GUID happens outside the Android system meaning it happens on your operating system the question is what else is changing besides the two registry values that i wrote, it's this patch button that i'm trying to understand what it does in the background:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
@jwoegerbauer BlueStacksTweaker 5.16.1 is for Bluestacks 4 and it's Android 7.1.2 https://en.wikipedia.org/wiki/BlueStacks#BlueStacks_4
@pOOBs4 ok, I understand.
ROFL
OP makes use of BS 3.60.89.3419 and that's based on Android 4.4
If OP uses BS Tweaker 5.16.1 to tweak this BS version, so it's on his decision.
pOOBs4 said:
Already did but it's unlikely that he'll answer.
The GUID is for BlueStacks not to be confused with Android, it controls the IMEI, the Android ID and the WiFi Mac, the change to the GUID happens outside the Android system meaning it happens on your operating system the question is what else is changing besides the two registry values that i wrote, it's this patch button that i'm trying to understand what it does in the background:
View attachment 5921237
Click to expand...
Click to collapse
open this reg path: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\BlueStacks_bgp_kk\Config and change value of SYSTEM_GUID. This value is mandatory for BlueStacks.
if key is not available, open the log file in C:\ProgramData\BlueStacks_bgp_kk\Engine\Android\Logs and search for the GUID string. You'll find the registry path there:
Code:
00:00:01.256321 bstdevices: Bluestacks registry path : Software\BlueStacks_bgp_kk
00:00:01.256346 bstdevices: query string char count 37
00:00:01.256358 bstdevices: query system guid value 2ae31f3f-f939-8ed4-3e47-f7b11690ba51
WoKoschekk said:
open this reg path: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\BlueStacks_bgp_kk\Config and change value of SYSTEM_GUID. This value is mandatory for BlueStacks.
if key is not available, open the log file in C:\ProgramData\BlueStacks_bgp_kk\Engine\Android\Logs and search for the GUID string. You'll find the registry path there:
Code:
00:00:01.256321 bstdevices: Bluestacks registry path : Software\BlueStacks_bgp_kk
00:00:01.256346 bstdevices: query string char count 37
00:00:01.256358 bstdevices: query system guid value 2ae31f3f-f939-8ed4-3e47-f7b11690ba51
Click to expand...
Click to collapse
As already stated on my first post changing the value of SYSTEM_GUID and IsIncludeMachineGUID is not enough, you can test it, it keeps reverting to the old GUID and in some cases assing a new one, i'm not saying that you're wrong i'm saying that there's something missing to be also modified to make the edited registry values work.
pOOBs4 said:
As already stated on my first post changing the value of SYSTEM_GUID and IsIncludeMachineGUID is not enough, you can test it, it keeps reverting to the old GUID and in some cases assing a new one, i'm not saying that you're wrong i'm saying that there's something missing to be also modified to make the edited registry values work.
Click to expand...
Click to collapse
I tested it with BlueStacks v3.60.89.3419 and BSTweaker v5.3.0 (post #5, screenshot). Changing GUID with Tweaker => registry change and vice versa. I also cross checked the results with AIDA64. No problems.
WoKoschekk said:
I tested it with BlueStacks v3.60.89.3419 and BSTweaker v5.3.0 (post #5, screenshot). Changing GUID with Tweaker => registry change and vice versa. I also cross checked the results with AIDA64. No problems.
Click to expand...
Click to collapse
Did you press unpatch before anything ?
Because if you do any registry change will not take effect, that's why i'm trying to understand what the patch button does.
pOOBs4 said:
Did you press unpatch before anything ?
Click to expand...
Click to collapse
first I used the Tweaker and pressed patch to change the GUID. Then I verified the GUID in registry and also started BS > AIDA64 to cross check the Android ID. After Tweaker and BS have been closed, I opened regedit > edit the value > started Tweaker and BS/AIDA64 again for verification.
Always used a new and unique GUID.
press unpatch will only restore a backup created by the Tweaker. the GUID change is done in the registry of BS itself. editing the registry manually is the same as using the Tweaker and doesn't depend on it.
WoKoschekk said:
first I used the Tweaker and pressed patch to change the GUID. Then I verified the GUID in registry and also started BS > AIDA64 to cross check the Android ID. After Tweaker and BS have been closed, I opened regedit > edit the value > started Tweaker and BS/AIDA64 again for verification.
Always used a new and unique GUID.
Click to expand...
Click to collapse
To verify your work you need to press unpatch before changing anything, closing BlueStacks Tweaker doesn't mean that it's unpatched now, the whole point of this topic is to change the GUID manually without relying on BlueStacks Tweaker.
WoKoschekk said:
press unpatch will only restore a backup created by the Tweaker. the GUID change is done in the registry of BS itself. editing the registry manually is the same as using the Tweaker and doesn't depend on it.
Click to expand...
Click to collapse
The GUID will not change if BlueStacks is not "patched", that's what i'm trying to understand, to figure out what does the patch button do and why it's important.
Ok sooo after deeply analyzing the program i figured out what the patch button does, it modifies the HD-Common.dll file located in C:\Program Files (x86)\BlueStacks_bgp_kk and with that said enough messing around and let's get down to business.
How to change the GUID manually on BlueStacks 3.60.89.3419 ?
First: Open HxD as an administrator then open the HD-Common.dll file and do the following:
Code:
0005C279 55005500
Meaning go to the offset 0005C279 and then write the value 55005500.
Second: Modify the following registry value with the desired GUID, i'll be choosing 00000000-0000-0000-000000000000:
Code:
[HKEY_LOCAL_MACHINE\SOFTWARE\BlueStacks_bgp_kk\Config]
"SYSTEM_GUID"="00000000-0000-0000-000000000000"
And that's it