Related
This NEEDS to be stickied in here so everyone can use it.
I copied this from the i9000 forum.
Ok before we get started I need to make this REALLY clear. This did not work for my i9000 at first…. I cannot guarantee you will find your code…. If your device freezes (to many attempts) I am sorry but I cannot be held responsible.
Using ADB
Step 1. – Get the file
You need to have root
Code:
adb shell
su
dd if=/dev/block/bml3 of=/sdcard/bml3.bak
mount USB storage and copy the file off the internal SD card
Step 2. – Find the code
Try this
Originally Posted by rbnet.it
Try this: http://www.multiupload.com/2IAYWWGF8A
It's a win32 executable. Run the program from command line with the blockdevice backup as parameter:
c:\sgux.exe bml3.bak
IT returns the unlock code fory your phone.
It's based on the tip posted on this thread by rhcp0112345.
It's works with european sgs.
Click to expand...
Click to collapse
OR
Open the file in a HEX editor
Search for SSNV
At the end of this block of data there should be a string of numbers
(my unlock code started at 0x18005a)
The format will be numbers.unlockcode.numbers
Step 3. – Enter the code
As far as I know the *#0111*code# and #7465625*638*Code# codes don’t work so you MUST
Power down your phone
Put in a SIM card from another carrier
Power up your phone
When it boots up it will ask for the unlock code that you found above
Step 4. – Flash back (IF THE CODE DIDN'T WORK)
Flash back to an older firmware (I9000XXJF7 with 513.pit worked for me)
Now enter the unlock code you generated in Step 2.
PLEASE give credit to
rhcp0112345 for finding the file and giving me (and others) a place to start
rbnet.it and marcopon for the cool utility to extract it
galaxysguy for starting the other thread and confirming that I was looking at the right code
Click to expand...
Click to collapse
Think this is the 3rd post I've seen on this, but this has been CONFIRMED to work!
sweet, just unlocked mine!! thanks guys!
ill make sure this gets stickied
Hi,
I have used this procedure but was unsuccessful since I don't have the SIM from another carrier? Which method did you use? also I am currently running JH3 firmware.
thanks
TZ
tzones said:
Hi,
I have used this procedure but was unsuccessful since I don't have the SIM from another carrier? Which method did you use? also I am currently running JH3 firmware.
thanks
TZ
Click to expand...
Click to collapse
you NEED another sim from another carrier to invoke the message to enter the unlock code.
Error: unable to find file <bml3.bak>. can some1 help? thx
i had sgux.exe and bml3.bak copy to drive c: "windows 7"
Yep, put an old no longer working TMobile sim in, it asked for my code and voila! worked like a champ.
file not found on JH3
_____________________
did a direct copy and paste of string from thread and it copied properly.
Unlocked successfully from JH3!!!!
Yeah *****es!!!!
akachay said:
Error: unable to find file <bml3.bak>. can some1 help? thx
i had sgux.exe and bml3.bak copy to drive c: "windows 7"
Click to expand...
Click to collapse
Krad said:
file not found on JH3
Click to expand...
Click to collapse
Remember after opening adb, type su enter
then
cat /efs/nv_data.bin >> /sdcard/nv_data.bin
mount your card, and transfer nv_data.bin along with sgux.exe to your c :\ drive
then open command prompt, and cd C:\ [ENTER]
C:\sgux.exe nv_data.bin [ENTER] and you should get your code.
Make sure you have su (superuser) working, you can tell if there's a #in the adb prompt
If there's no # in the adb prompt, then open adb, type su [ENTER] look at your phone, and wait for the Super User prompt to pop and enable/give permissions.
The Bishop said:
Yep, put an old no longer working TMobile sim in, it asked for my code and voila! worked like a champ.
Click to expand...
Click to collapse
Thanks for this mail since I was under the impression that it requires a working SIM. Can't believe that my phone is unlocked!!
nice guide... but why are there so many different unlock guides lol
Honestly, I just found a guide that I thought had the best instructions and made a thread about it, hoping that it would be stickied, becasue this does not need to fade away off the first page. If it were stickied, it'd be even better. I contacted the person over this board, but they have yet to reply.
Extracting the unlock code on Ubuntu
Once you get the file off of your phone you can use hexdump and grep to find the unlock code easily:
cat bml3.bak | hexdump -C | grep -A 10 SSN
Ideally we could figure out how to do this directly on the phone using busybox, but I haven't figure that out yet.
Bad ass! worked like a charm on JH3.
i need help, i havent been able to get my phone unlocked.
I've tried all the methods (except Paying for a code) and none have worked !!!
I tried this one and it gave me the code but when i put in the TMO sim and entered "the code" it came back as no good.
Now, sgux.exe states looking for code and then it moves to the next command line (as if it was finished) but it doesnt find the code.
Help me plz !!
PS: I got the files out of the phone, both the bml3.bak and the nv_data.bin !
I9000 unlock instructions
1. Power on the phone and go to Applications->Settings->About Phone->USB
settings
2. Select Mass Storage
3. Connect the phone to USB cable
4. Swipe down the top notification bar then tap “USB Connected” then select
MOUNT
5. Copy update.zip file to phone mass storage root
6. Power off the phone
7. Press Volume Up+Home+Power on key to start the phone into recovery
mode
8. Go to “apply sdcard:update.zip” using volume keys then select it using
home key
9. Power on the phone then go to Andoid Market and install Terminal
Emulator
10. Run Terminal Emulator
11. Type cat /efs/nv_data.bin >> /sdcard/nv_data.bin into terminal then type
Enter
12. Connect the phone to PC in USB Storage Mode then copy nv_data.bin file
to your pc
13. Open nv_data.bin file with any hex editor (ex. Hex workshop) then go to
address 00181460
14. There are the codes
15. Power on the phone with any unaccepted sim card inside then type in the
first code to unlock the phone
I9000 drivers
I9000 drivers
This solution is is not working for me. The problem is that the Update.zip says:
E: Signature verfication failed
Installation aborted
Any advice? How to install that update.zip package?
cellularhut said:
I9000 unlock instructions
1. Power on the phone and go to Applications->Settings->About Phone->USB
settings
2. Select Mass Storage
3. Connect the phone to USB cable
4. Swipe down the top notification bar then tap “USB Connected” then select
MOUNT
5. Copy update.zip file to phone mass storage root
6. Power off the phone
7. Press Volume Up+Home+Power on key to start the phone into recovery
mode
8. Go to “apply sdcard:update.zip” using volume keys then select it using
home key
9. Power on the phone then go to Andoid Market and install Terminal
Emulator
10. Run Terminal Emulator
11. Type cat /efs/nv_data.bin >> /sdcard/nv_data.bin into terminal then type
Enter
12. Connect the phone to PC in USB Storage Mode then copy nv_data.bin file
to your pc
13. Open nv_data.bin file with any hex editor (ex. Hex workshop) then go to
address 00181460
14. There are the codes
15. Power on the phone with any unaccepted sim card inside then type in the
first code to unlock the phone
Click to expand...
Click to collapse
Fantastic find if it works, my phone is unlocked so I can't test it but thanks a lot for sharing!!! Priceless
N.B. The first 8 steps are the process for rooting your phone, since you need to be root to do step 11. If you already have a rooted phone, start from step 10.
tyxerakias said:
fantastic find if it works, my phone is unlocked so i can't test it but thanks a lot for sharing!!! Priceless
n.b. The first 8 steps are the process for rooting your phone, since you need to be root to do step 11. If you already have a rooted phone, start from step 10.
Click to expand...
Click to collapse
1000000000000000% working tested before post here !!!!!
I am following 100% tutorial but I am unable to unlock my I9000. Look at the screenshot for the error that I encounter.
I have put the update.zip in root of phone memory, root of MicroSD etc but no chance. Do I need to root the phone or what's the problem?
Thanks
erreterr said:
I am following 100% tutorial but I am unable to unlock my I9000. Look at the screenshot for the error that I encounter.
I have put the update.zip in root of phone memory, root of MicroSD etc but no chance. Do I need to root the phone or what's the problem?
Thanks
Click to expand...
Click to collapse
Please read my post above. By doing this, you are rooting your phone.
It seems that the update.zip has not been properly signed, I see that it contains a new busybox, maybe the OP tried to optimise it and failed?
Use the original update.zip from the FAQ (http://www.multiupload.com/JHIFK9K80P) to root your phone, then continue from step 9.
The same happens with the file that I downloaded from your posted link!!!
Whats going wrong here?
Tyxerakias said:
Please read my post above. By doing this, you are rooting your phone.
It seems that the update.zip has not been properly signed, I see that it contains a new busybox, maybe the OP tried to optimise it and failed?
Use the original update.zip from the FAQ (http://www.multiupload.com/JHIFK9K80P) to root your phone, then continue from step 9.
Click to expand...
Click to collapse
No idea. Have you rooted your phone already? Have you installed any mods or firmwares?
No need to root
You dont need to root your phone to get to Step 11. The Terminal Emulator I installed from the Market let me do Step 11 directly.
All I then just did was email the nv_data.bin file to my inbox and later just open it in Textpad.
So, it was a bad tutorial. I tried to go step by step but now I begin from step 11 and everything is OK. My first I9000 unlocked like a charm
Thanks
knkartha said:
You dont need to root your phone to get to Step 11. The Terminal Emulator I installed from the Market let me do Step 11 directly.
All I then just did was email the nv_data.bin file to my inbox and later just open it in Textpad.
Click to expand...
Click to collapse
Huh. Interesting. I would have thought /efs is a protected folder.
I have a Bell one, i asked their staff when i bought my phone if i still on WARRANTY when i unlock the phone by Bell, they said yes.
Anybody know if i will lose my phone WARRANTY after i unlock the phone? Or can i lock it back if my phone have any problem in the future?
Thanks
could somebody point out which value in the address 00181460 says the unlock code?
erreterr said:
The same happens with the file that I downloaded from your posted link!!!
Whats going wrong here?
Click to expand...
Click to collapse
you should put the update.zip file on your internal sd card directory.
i encountered the same error when i put the update.zip file in the external sd card
erreterr said:
So, it was a bad tutorial. I tried to go step by step but now I begin from step 11 and everything is OK. My first I9000 unlocked like a charm
Thanks
Click to expand...
Click to collapse
which of the values in the said address gives the unlock code?
Hi,
I have a NSPRO box and read the unlock code, but as I insert it, it doesn't unlock the phone.
As this didn't work, I tried your method, and the code that showes up is the same as read by NSPRO box, and... it still doesn't work.
Attached is the printscreen of the HEX area where the code is. I've noticed it says "18146D" and not "181460" as your indicated. Could this be the reason why the code doesn't work?
Please help...
Samsung Vibrant SGH-T959 Recovery Mode
I've tried all sorts of button combinations to get the Samsung Vibrant T959 into recovery mode. I think since this device is a T-Mobile phone, the firmware has been modified for VolUp+VolDn+Pwr recovery mode.
As of now, the only way I know how to get the phone into recovery mode is by using the Android SDK and sending off a command: adb reboot recovery
I've been putting together an Android SDK & Rooting tutorial as well as other Samsung Vibrant T959 findings here: jordanpeterson.me/content/t-mobile-samsung-vibrant-sgh-t959
Sorry.. the external references aren't working.. Good spam rules on new users.
Thanks
Jordan
It worked great, althoug the address on my I9000 was 00181462. My suggestion is try to find closest address to the given by the tuturial....
Thanks for everything
Don't need to root the device. Download terminal emulater from Market. Went straight to step 10. Works like a charm. Thanks for the instructions.
Sent from my GT-I9000M using XDA App
for those of u having a very very hard time trying to unlock the phone after flashing the JPC rom , u must do this :
7. My Phone asks me for a Unlock Code. Product Code has changed to KOR. What to do?
- Your Phone have to be rooted! Busybox is required!
- Start->Run-> cmd
- Change to your SDK\tools Directory e.g cd C:\Program Files (x86)\Android SDK\tools
- adb shell
- su
- cd /efs
- ls -al
If now nv_data.bak AND nv_data.bak.md5 are displayed, do the next few steps marked with (a)
If now .nv_data.bak AND .nv_data.bak.md5 are displayed (dot before filenames), do the next few steps marked with (b).
(a)- mv nv_data.bin nv_data.jpc
(a)- mv nv_data.bin.md5 nv_data.jpc.md5
(a)- mv nv_data.bak nv_data.bin
(a)- mv nv_data.bak.md5 nv_data.bin.md5
(a)- reboot
(b)- mv nv_data.bin nv_data.jpc
(b)- mv nv_data.bin.md5 nv_data.jpc.md5
(b)- mv .nv_data.bak nv_data.bin
(b)- mv .nv_data.bak.md5 nv_data.bin.md5
(b)- reboot
Now your Phone shouldn´t ask for a Code.
after that u can unlock ur phone with the methods shown in this thread . even the unlock android apk works ! very good job developers ty. BAD BAD samsung setting us such a trap.
For me this method didn't work. following exact steps in (b), still asking Network Code, 00000000 was the extracted code but didn't work though.
So after 2 days of struggling this is what I did:
Note that some users warned that if the bak files are corrupted the system will recreate empty files, probably losing IMEI, but this was not my case
1. Flash by Odin to JM7 (I don't think the version matters as long is 2.1)
2. at this time Product code change back from KOR to original ORO, but still asking code
3. root
4. moving back /efs files active to bak, the system will recreate new ones due to moving, so no more active files
mv nv_data.bin .nv_data.bak
mv nv_data.bin.md5 .nv_data.bak.md5
at this time I can see a new nv_data.bin with a smaller size
5. reboot
now working, not asking code
Thanks for the Thread... Might just need it in a few hours
adi_g_s said:
For me this method didn't work. following exact steps in (b), still asking Network Code, 00000000 was the extracted code but didn't work though.
So after 2 days of struggling this is what I did:
Note that some users warned that if the bak files are corrupted the system will recreate empty files, probably losing IMEI, but this was not my case
1. Flash by Odin to JM7 (I don't think the version matters as long is 2.1)
2. at this time Product code change back from KOR to original ORO, but still asking code
3. root
4. moving back /efs files active to bak, the system will recreate new ones due to moving, so no more active files
mv nv_data.bin .nv_data.bak
mv nv_data.bin.md5 .nv_data.bak.md5
at this time I can see a new nv_data.bin with a smaller size
5. reboot
now working, not asking code
Click to expand...
Click to collapse
and did you manage to get the JPC back and unlocked then? I have managed to fix the SIM Network Unlock code problem in a similar way, but using a MoDaCo modded froyo ROM, based on JP3. Now I am considering getting back to JPC, because I saw some nice things in there, but afraid I might get into the same problem. How can we fix this problem and STILL be on JPC?
NOTE: I have tried to use the .apk to get the unlock code now in JP3 rom and with no network unlock and the result is:
Unlock code: NULL
Unfreeze code: NULL
Probably that means that my sgs is unlocked, but how can we find the unlock code, so we can use it in JPC after flash?
ionutz6 said:
and did you manage to get the JPC back and unlocked then? I have managed to fix the SIM Network Unlock code problem in a similar way, but using a MoDaCo modded froyo ROM, based on JP3. Now I am considering getting back to JPC, because I saw some nice things in there, but afraid I might get into the same problem. How can we fix this problem and STILL be on JPC?
Click to expand...
Click to collapse
I think you can use JPC as long as you keep it rooted. If it gets locked, you can do the above procedure (adb shell) and restore the nv_data files
If you need to know how to flash it already rooted, check the "JPC root inside" thread or the "Doc's RomMod JPC" thread. I'm going to test this myself tonight or tomorrow
Cheers m8s
Phk
Phk said:
I think you can use JPC as long as you keep it rooted. If it gets locked, you can do the above procedure (adb shell) and restore the nv_data files
If you need to know how to flash it already rooted, check the "JPC root inside" thread or the "Doc's RomMod JPC" thread. I'm going to test this myself tonight or tomorrow
Cheers m8s
Phk
Click to expand...
Click to collapse
I have tried pretty much ALL things found here in XDA related to JPC last night, in the 10-hour period when I was struggling to bring my sgs back to life. I have upgraded to JPC, rooted it, tried to use several methods to find the unlock code, tried the FAQ#7 from the HOWTO thread, did 1000 other things, nothing worked, Unlock code still present. Perhaps I missed some steps although I don;t think so. I've also downgraded to 2.1 JM6 and tried to get the unlock code here, no go. Still SIM Unlock Code required. Finally I have solved it by upgrading it to a froyo modded rom from modaco, already rooted and then applying the FAQ#7 instructions. Now I am in froyo JP3 (the modded rom from modaco) and pretty scared to try anything else, although I would very much like to get to JPC, since I saw some pretty nice enhancements.
Any thoughts based on this painful story?
adi_g_s said:
For me this method didn't work. following exact steps in (b), still asking Network Code, 00000000 was the extracted code but didn't work though.
So after 2 days of struggling this is what I did:
Note that some users warned that if the bak files are corrupted the system will recreate empty files, probably losing IMEI, but this was not my case
1. Flash by Odin to JM7 (I don't think the version matters as long is 2.1)
2. at this time Product code change back from KOR to original ORO, but still asking code
3. root
4. moving back /efs files active to bak, the system will recreate new ones due to moving, so no more active files
mv nv_data.bin .nv_data.bak
mv nv_data.bin.md5 .nv_data.bak.md5
at this time I can see a new nv_data.bin with a smaller size
5. reboot
now working, not asking code
Click to expand...
Click to collapse
so should i understand that you are now on JM7? How do you get back to JPC?
ionutz6 said:
and did you manage to get the JPC back and unlocked then? I have managed to fix the SIM Network Unlock code problem in a similar way, but using a MoDaCo modded froyo ROM, based on JP3. Now I am considering getting back to JPC, because I saw some nice things in there, but afraid I might get into the same problem. How can we fix this problem and STILL be on JPC??
Click to expand...
Click to collapse
yes now i am on jpc ,and if it decides to ask for a code i have the codes now.
ionutz6 said:
so should i understand that you are now on JM7? How do you get back to JPC?
Click to expand...
Click to collapse
yes I'm on JM7, now the unlock.apk gives me Unlock Code:NULL
I'm hoping that my phone is unlocked now, so Froyo will not ask the code anymore
but IMEI was rewritten by with value 004999... and I have trouble with Market, cannot download.
how to recover my IMEI now?
Many many many thanks
adi_g_s said:
For me this method didn't work. following exact steps in (b), still asking Network Code, 00000000 was the extracted code but didn't work though.
So after 2 days of struggling this is what I did:
Note that some users warned that if the bak files are corrupted the system will recreate empty files, probably losing IMEI, but this was not my case
1. Flash by Odin to JM7 (I don't think the version matters as long is 2.1)
2. at this time Product code change back from KOR to original ORO, but still asking code
3. root
4. moving back /efs files active to bak, the system will recreate new ones due to moving, so no more active files
mv nv_data.bin .nv_data.bak
mv nv_data.bin.md5 .nv_data.bak.md5
at this time I can see a new nv_data.bin with a smaller size
5. reboot
now working, not asking code
Click to expand...
Click to collapse
Finaly I have my phone back. just had to do something else.
I have to edit the file efs/imei/mps_code.dat and change de "KOR" to "TMN". Then I rename the files as mentioned, and my phone came to life.
adi_g_s you're a hero.
adi_g_s said:
yes I'm on JM7, now the unlock.apk gives me Unlock Code:NULL
I'm hoping that my phone is unlocked now, so Froyo will not ask the code anymore
but IMEI was rewritten by with value 004999... and I have trouble with Market, cannot download.
how to recover my IMEI now?
Click to expand...
Click to collapse
I have the exact same behaviour, with Unlock code: NULL, IMEi starting with 004999.. etc. The only thing is that download from market is working ok.
would you care to upgrade now to JPC and see if it requests the unlock code again? I don;t believe that the fact that it looks unlocked now will mean after installing JPC you will have the same condition. Mine was unlocked before trying JPC, as far as I know.
man, i am confused...
I want to give the method by adi_g_s a try but im afraid if I reflash back to JPC it might forever lock my phone.. the unlock APK also sees it as null/null. Right now im with JPC and its unlocked..
adi_g_s said:
For me this method didn't work. following exact steps in (b), still asking Network Code, 00000000 was the extracted code but didn't work though.
So after 2 days of struggling this is what I did:
Note that some users warned that if the bak files are corrupted the system will recreate empty files, probably losing IMEI, but this was not my case
1. Flash by Odin to JM7 (I don't think the version matters as long is 2.1)
2. at this time Product code change back from KOR to original ORO, but still asking code
3. root
4. moving back /efs files active to bak, the system will recreate new ones due to moving, so no more active files
mv nv_data.bin .nv_data.bak
mv nv_data.bin.md5 .nv_data.bak.md5
at this time I can see a new nv_data.bin with a smaller size
5. reboot
now working, not asking code
Click to expand...
Click to collapse
If i flash back to 2.1 and I still get the KOR product code.. I wont be doing the other extra steps right ?
and If i flash back to JPC, should I expect my phone to be asking for an unlock code again ?
EDIT:
and I made a backup of my:
nv_data.bak
nv_data.bin
nv_data.bin.md5
nv_data.jpc
nv_data.jpc.md5
all of these are from POST JPC, so I guess im ready to screw around and flash to JM7 and see if i can get my product code back and if not I can just relfash to JPC again and restore these files so it wont be asking for an unlock code anymore right ?
adi_g_s said:
yes I'm on JM7, now the unlock.apk gives me Unlock Code:NULL
I'm hoping that my phone is unlocked now, so Froyo will not ask the code anymore
but IMEI was rewritten by with value 004999... and I have trouble with Market, cannot download.
how to recover my IMEI now?
Click to expand...
Click to collapse
There is a file in /efs/imei/ folder that contains the imei. if you have a original box perhaps you find there imei written, and that way you can try editing that file and place your original IMEI.
Hi everyone. As I found out there's root for the G4 but doing this isn't easy especially if your variant is hard to find or has less users. This may result in you waiting for longer than you should. This thread is for those who can take things into their own hands and do it themselves. The tools are available everywhere but I'll give you the best order and steps. I'm using the China LG G4 H818 Dual SIM variant but this method is UNIVERSAL FOR ALL LG G4s.
The process will involve extracting a system image, injecting root and reflashing this image. Most of the steps are effortless and need just copy and paste with keen eyes. Do it slowly. You need an Ubuntu installation for step 2 of this 3-step tutorial. I used universal USB installer and put in on my 8GB USB. Anywhere will do so far as it boots&works. Beware this thread is not dumb-proof but this will not wipe your data or void your warranty if done successfully.
Step 1 -> Getting the proper system image.
Check here and skip to step 3 if you have your rootedsystem.img
>Don't worry because this doesn't require searching. It is from your device. Every device has a system partition and this method will pull it out as an image without root required.
1--Make sure all drivers are installed properly. I'll not be talking about this. We're on XDA not kindergarten.
2--Download the LG_root file or send command file from here and extract it. US Carrier specific check here
3--Put your device in download mode and connect it to your PC.
4--Open(double-click duh) port.bat and make sure to write down the number after com. There maybe different com numbers but choose the com on the DIAG1 line and write down that number. This is important.
5--Hold shift and right-click in any empty space in the extracted folder. Choose open command windows here.
6-- In that copy and paste this
Code:
[FONT=Lucida Console][COLOR=#ff8c00]Send_Command.exe \\.\COM[/COLOR][COLOR=#00ff00][*insert your number here][/COLOR][/FONT]
7--Now you're in send command mode. Nothing looks different on your phone but that's ok. It should just remain in download mode.
8-- On the computer screen in the window you now see #.
9--Now in this post copy the Backup system to internal storage command specific to your device model number. Check in you settings >general >about if in doubt. This is the most important step. Copy the whole line of code. Highlight with your mouse, select everything on the line and copy.
10--You didn't come all this way to fail so do it. Remember it is device model specific.
11-- Paste it in the command window and hit enter. It should take a while so wait until you see#reappear.
12--Now typeLEAVEall in capital letters. Your device will reboot. Check using the file manager if you have a file called system.img in your internal storage. If yes step 2 is next and you did well. If no repeat it and follow the steps properly. Make sure drivers are installed especially windows 10/8/8.1 users. Check device manager
Step 2 -> Root injection.
1--Prepare your Ubuntu USB or virtual machine or computer.
2--Download inject_root zip from here and extract.
3--Copy the system.img from your phone to the extracted inject_root folder on your PC.
4-Reboot into Ubuntu.
5--Here open a terminal.
6--Gain root access on Ubuntu by typing or copy and paste sudo -i
7--You should either be asked for your password which you have to enter or if you used a USB drive like me you'll see the name change to[email protected]
8--Navigate to the inject_root folder by using cd commands. This can also be done by typing cd then [space] then dragging and dropping the folder into the terminal and hitting enter.
9--You'll now see the name in the terminal become longer with the name of the folder in it.
10--Now type chmod +x autoroot.sh
11--Hit enter then sudo ./autoroot.sh
12--If you get any thing like command not recognized or something of the sort use sudo sh autoroot.sh
-That worked for me.
13--If you're successful the name of the file should change from system.img torootedsystem.img
-Please note don't rename the files. Leave them as they are.
14--Now go back to Windows let's finish this.
Step 3 ->Root
1--Transfer the rootedsytem.img to your phones internal storage.
2--Put your phone in download mode and connect it to your PC.
3--Get into send command mode as in step one.
-Put your device in download mode and connect it to your PC.
-Open port.bat and make sure to write down the number after com. There maybe different com numbers but choose the one that has DIAG1 on the same line as it. Note it down this is important.
-Hold shift and right click in any empty space in the extracted folder. Choose open command windows here.
- In that copy and paste this
Send_Command.exe \\.\COM[*insert your number here]
-Now you're in send command mode. Nothing looks different on your phone but it's find. It should just remain in download mode.
4-Now grab your command to flash system.img line of code from this post. It isn't the same as step one. Copy that an paste in the command window. Make sure it is for your device. They are model specific.
5--This should take a while so wait until you see the # again.
6--After thatLEAVEand upon reboot you should have root.
To Un-root just flash a KDZ file compatible with your device here.
Testimonies
Spudnubs said:
Rooted H812 10g for my fellow Canadians. Enjoy!
https://www.androidfilehost.com/?fid=24052804347821979
Click to expand...
Click to collapse
Wildsheep said:
This root method works for my G4 purchased in Singapore (H815 SEA)
Click to expand...
Click to collapse
luongquang said:
Thanks to @hackarchive, H818p10f done with tut.
Click to expand...
Click to collapse
player911 said:
Fantastic. This method will also ease devs for future rooted firmwares. I really cannot see LG being able to patch this, since this is basically a 3rd party LG Flashing tool. If they block this method, then their own tool will ultimately die with it.
Click to expand...
Click to collapse
GavTheStoner said:
Fantastic! I had almost given up hope of root on my EE LG G4. Have just used this method and now rooted perfectly!
hackarchive You rock! Have a thanks!
Click to expand...
Click to collapse
articular said:
everything worked fine and i successfully got my g4 rooted
my variant is H815TR
all steps easy only the ubuntu part was a bit hard especially for a windows user ( finding an ubuntu version and usb install etc. not root injection part)
ty ty ty again )
Click to expand...
Click to collapse
rirozizo said:
if it were for me to decide if we should delete the low effort root method, i'd totally delete it.
"The more 'manual', the better"
Click to expand...
Click to collapse
Moe5508 said:
Only method that roots my device successfully...I updated to 10e of the H815P and using this method (and only this!0 I was able to root my phone...ah felt so good...
The other 1-click rooting methods I came across in other parts of this forum just fail on the G4...
Click to expand...
Click to collapse
Marshmallow and root situation read here
Hit thanks if you appreciate. Hope I helped.
Credits to them whom without this won't be possible :good:
Thecubed
Team Codefire
ManhIT
This is a good method, thanks for writing this up.
I would like to add a few points....
I recommend you do keep your original system.img on your phones regular internal storage. If you encounter any boot issues you can then re-enter download mode and write the original system.img over the top of the failed root attempt. Use the same command from "step 3: root" but replace rootedsystem.img with system.img. This should still be on your phone from step 1 and will recover your phone from a failed root injection attempt. Note that it will not recover your phone if you messed up the dd command and overwrote other partitons. Be sure to use the right dd command and cut n paste to prevent seek/offset typeos.
I also recommend that you keep a backup of your system.img on your pc. When you run autoroot.sh in step 2 the copy on your pc will be renamed and patched. I suggest copying system.img somewhere else first, or re-copy it off your phone.
Additional credits to blog.lvu.kr. This is the blog of the hobbyist who reverse engineered the download mode protocol, created send_command.exe and gave it to the world. Kudos to you.
How is this any easier than the original method....if anything this requires even more work
kyle1867 said:
How is this any easier than the original method....if anything this requires even more work
Click to expand...
Click to collapse
It's for those who have rare variants.
psycho_asylum said:
It's for those who have rare variants.
Click to expand...
Click to collapse
Then you should probably take out the claim that this method is easier from the OP
Can this be used to inject Xposed as well for those of us with locked BLs.
djkinetic said:
Can this be used to inject Xposed as well for those of us with locked BLs.
Click to expand...
Click to collapse
No, we need to wait for a custom recovery.
psycho_asylum said:
No, we need to wait for a custom recovery.
Click to expand...
Click to collapse
Just used flash fire it worked rocking xposed now on 810!
djkinetic said:
Just used flash fire it worked rocking xposed now on 810!
Click to expand...
Click to collapse
Oh nice! I wasn't adventurous enough to try it. I'll make a system backup and give it a whirl!
Very nice thread, thank you. The steps were short, few, and fairly concise.
I was waiting for something like this where I could modify my own image and I wouldn't have to wipe everything or replace it with a new image.
One thing you might want to mention is that if your phone is encrypted, you'll need to unencrypt it first.
Can anyone link me to some instructions on how to disable OTA updates for an unlocked/international H815T?
kyle1867 said:
How is this any easier than the original method....if anything this requires even more work
Click to expand...
Click to collapse
This is what XDA is all about. It tells you how to inject root into your OWN system image. it's the opposite of spoon feeding. it's about teaching members how to do things for themselves. Too many people come here expecting to be spoon fed and have thigns done for them. This thread teaches people how to do their own work, while learning something at the same time.
Good work OP! :good:
the_scotsman said:
This is what XDA is all about. It tells you how to inject root into your OWN system image. it's the opposite of spoon feeding. it's about teaching members how to do things for themselves. Too many people come here expecting to be spoon fed and have thigns done for them. This thread teaches people how to do their own work, while learning something at the same time.
Good work OP! :good:
Click to expand...
Click to collapse
Thanks. I guess people don't know what XDA is about. Seeing noobs and others trying to spit on hard work when I used my time and device as Guinea pig. Also people don't know this is almost brick-proof because the system image if from their devices. Unless they use wrong commands but all here is just copy and paste. They see lot's of text and get cold feet. Anyways will be updating the OP with system images. If yours is available please share. If you see your image available and you have drivers and LG_root downloaded proceed to step 3.
The only downside is that I have to drag out my windows laptop instead of doing everything on the ubuntu machine I use at work.
But if that's the biggest of my problems then I don't really have a problem
hi, thx for this tutorial, looks good
when flashing back the rooted img,does it wipe everything ? apps, data ... etc
thx
EDIT: just correct me if im wrong
using this method WILL NOT wipe everything on my device cause im rooting my system with everything on it
correct ???
must make sure before i go ahead
thx
How to calculator extractly bs/seek/count ?
Is there a possibility of any personal data being written to /system on a phone during normal use? I can provide 10c Optus AU (carrier 505-02) if I can be sure its not identifying, but ive been using the phone a couple of weeks.
Download link:
https://www.androidfilehost.com/?fid=24052804347799013
optiplex2012 said:
using this method WILL NOT wipe everything on my device cause im rooting my system with everything on it
correct ???
Click to expand...
Click to collapse
correct.
---------- Post added at 06:01 PM ---------- Previous post was at 05:29 PM ----------
djkinetic said:
Can this be used to inject Xposed as well for those of us with locked BLs.
Click to expand...
Click to collapse
HTCuser90 said:
How to calculator extractly bs/seek/count ?
Click to expand...
Click to collapse
I would also like to know this. You can resolve system by running the following. Note that this is for the H815T and is not the same on all variants.
# ls -lZ /dev/block/bootdevice/by-name/system
You'll get something like:
lrwxrwxrwx root root ubject_r:block_device:s0 system -> /dev/block/mmcblk0p47
Which tells you the actual block device (partition its on).
And you can see the size of that with:
# cat /proc/partitions
where you see:
major minor #blocks name
<snip>
259 15 4239360 mmcblk0p47
<snip>
However I dont know how to identify how large a block is or how to calculate the start offset in the main partition.
ok, it worked great
wasnt easy, since im not so familiar with using ubuntu, but all is ok
the explanation of the how to... was great and nothing lost
my H815L is now rooted
thx guys
djkinetic said:
Just used flash fire it worked rocking xposed now on 810!
Click to expand...
Click to collapse
I know it's kind of going off topic, but I figured I'd mention that Flash Fire doesn't work on VS986. It just goes to a black screen and sits there forever. I left it sit for almost an hour. I saw elsewhere it has something to do with automount, I'll have to mess with it further.
hackarchive said:
Hit thanks if you appreciate. I spent hours trying to root so hope I helped.
Click to expand...
Click to collapse
Appreciated but you should include a way to unroot (undo) as well, ie how do we get back to stock (if required) ?
I have finally been able to get VoLTE working on my X Performance despite my carrier never having 'supported' my handset (they never sold it here).
What you will need?
Windows Computer with Flashtool and minimal ADB and fastboot (if you have already downloaded fimrware as below you can use flashtool on whatever platform your prefer)
Bootloader Unlocked
TWRP
ROOT (Magisk Preferred)
VoLTE enabled firmware (not sure about this one I think you can edit build.prop appropriately)
To unlock Bootloader, TWRP, and ROOT follow this guide
I will first describe how I did it and then how anyone else should be able to achieve the same outcome. Now includes a less convoluted way to do this allowing you to keep all data thanks to those who tested
1) First using a root file browser - I recommend this one browse to /system/etc/customisations/modem/
2) Check to see if there is any reference to your operator's modem in your model firmware. They are all in the format of amss_fsg_dora_xxx_tar.mbn
3) Once you have a spotted your operator you need to take note of what's in between 'dora_' and '_tar' so for example if I use china mobile - I would find amss_fsg_dora_china_mobile_hk_ims_tar.mbn I would need to take note of china_mobile_hk_ims
4) Once you have this you need to connect your phone via ADB to your PC (I found this much easier on a computer).
5) Enter the following commands adb root then adb shell
6) mount -o rw,remount /oem
7) vi /oem/modem-config/modem.conf
8) press 'i' on your keyboard to enter edit mode and delete whatever is in the file and replace it with your operator modem from step 3 - (china_mobile_hk_ims in this example) then press 'ESC' and then ':wq'
9) make a backup of your important data
10) Turn off your phone, connect it into Flashmode to your PC (hold vol- while plugging in to the PC)
11) Flash your firmware with these options - do a wipe of all partitions. Tick the OEM box in the 'Exclude SIN' section. Alternatively follow this and avoid factory reset as per @pbarrette and @SGH-i200
12) Once you have completed reboot your phone and you should pickup VoLTE settings at setup.
IF you don't have root follow the guide earlier on how to backup TA, unlock bootoader
Flash a VoLTE enabled firmware. Install TWRP. Enter recovery (hold Vol- and power to start phone) install your preferred root option. Then connect your phone via ADB (step 5) to find your operator modem per step 3. Continue with Step 6&7. Start your phone.
I have tested this using existenZ 5.5. Theoretically should work for any Xperia phones with an OEM partition, however each phone might have a different modem name for the same operator ( I know this to be the case between the XZP and the XXP), however if you get the bit in between 'modelname_' and '_tar' and follow the same process for editing the modem.conf file you should get the same results.
Credit to
@sdugoten for Unlock, TWRP and ROOT guide
@akshay2shah for informing me of the modem selector tool for other Xperias
@VeixES for informing me of the oem.sin partition and modem.conf files
@niaboc79 for existenZ ROM (highly recommended)
@SGH-i200 and @pbarrette for testing and coming up with an easier way to use this (step 11)
Wipe all partition. It's too difficult.
Is it possible to enable VoWiFi for this device.? My phone carrier supports both VoWiFi and VoLTE on newer Sony Model. But only supports VoLTE on X Performance......
would not be a more detailed guide?
do not know how to copy ...
I did not find my operator ,,amss_fsg_dora_xxx_tar.mbn"
there is a link "default"
kodein said:
would not be a more detailed guide?
do not know how to copy ...
I did not find my operator ,,amss_fsg_dora_xxx_tar.mbn"
there is a link "default"
Click to expand...
Click to collapse
Is your operator an MVNO? You could try and see if using the underlying carrier modem is present? Otherwise see if another operator in your country's modem settings work ( unlikely but your only other option is to try till you have a modem setting that works). You could try looking at the apns-conf.xml file and see if there is an operator with similar settings if you know them.
bluesky1126 said:
Is it possible to enable VoWiFi for this device.? My phone carrier supports both VoWiFi and VoLTE on newer Sony Model. But only supports VoLTE on X Performance......
Click to expand...
Click to collapse
I have the same problem. Unfortunately I don't think there is any way unless you know the VoWiFi settings. I'll look into it. For me at least I'm no longer having dropped calls or missing out on important calls
chris_j26 said:
I have the same problem. Unfortunately I don't think there is any way unless you know the VoWiFi settings. I'll look into it. For me at least I'm no longer having dropped calls or missing out on important calls
Click to expand...
Click to collapse
I see......
Well, still congrats to you~
Please flashable zip sir
chris_j26 said:
1) First using a root file browser - I recommend this one browse to /system/etc/customisations/modem/
2) Check to see if there is any reference to your operator's modem in your model firmware. They are all in the format of amss_fsg_poplar_xxx_tar.mbn
Click to expand...
Click to collapse
If the mbn file is not there, can I copy it to this folder? What has to be changed after copying the file threre?
SGH-i200 said:
If the mbn file is not there, can I copy it to this folder? What has to be changed after copying the file threre?
Click to expand...
Click to collapse
If you got an mbn file it might work. However I suspect that it contains modem specific files if you copied it across from one device family (Xperia X , Xperia xz for example) it theoretically could work. I would imagine you would need to set permissions on the mbn file once copied I would think 1744 would do it but I'm not an expert on Android filesystem permissions. You could always do ls -la in terminal on the folder and replicate those permissions.
chris_j26 said:
10) Turn off your phone, connect it into Flashmode to your PC (hold vol- while plugging in to the PC)
11) Flash your firmware with these options - do a wipe of all partitions. Tick the OEM box in the 'Exclude SIN' section.
12) Once you have completed reboot your phone and you should pickup VoLTE settings at setup.
Click to expand...
Click to collapse
A Factory Reset is not needed to switch the active MBN! Please update point 11 to 'Flash cust-reset.ta' (and keep all your data and settings!):
pbarrette said:
I usually just flash the cust-reset.ta file. That clears the unit in the TA partition which holds the current carrier customization information.
Click to expand...
Click to collapse