Database Users

LG G5 RS988 Removing RAC (rent a center) remote locking software

Hello,
I hope this post is not against the rules, but I believe I found out how to remove the Rent a Center tracking and locking software that I believe if from computrace that is installed on our devices. It acts like a root kit that automatically reinstalls itself and has a device administrator profile that you can not remove.
I think I figured out how to get rid of the RAC (rent a center) lock for good. The rac lock uses a system administrator profile along with a program called sec.abt that can not be removed or frozen. If you manage to uninstall it is just reinstalls itself. I was not able to find any information on how to remove this without using special hardware like an octopus box that costs hundreds of dollars.
I used LGUP with the uppercut modification (can be found here on XDA) along with the KDZ files from here https://lg-firmwares.com/lg-rs988-firmwares/
I was only able to find the USA RSS 11C firmware until I found the page linked above with the BPT 10D firmware. Whenever you flash the stock 11C USA firmware the RAC program comes back and once connected to the net will lock your device, however if you use LGUP and uppercut to flash the BPT 10D firmware using the upgrade option (refurbish will error out) I found that my device booted correctly and seemed to work, however I did not have any fastboot options and it said there were no updates available (you need fastboot to unlock the bootloader and the latest update grants that ability). I then reinstalled the USA 11C firmware and to my delight found that the RAC software and device administrator profile were gone.
I then checked for updates and it started download the latest update. I believe I will not have a problem unlocking the bootloader and rooting from this point on. I'll let you guys know if anything changes.
I'm only posting this because I have been sitting on a RAC locked phone for months that got locked over six months after I bought it used and really hope this can help someone else that got screwed over.

Bought my phone almost a year ago off ebay woke up yesterday to this RAC device lock. This worked for me thanks.

Well done..
This happened to me after buying a device off of ebay.. thankfully RAC lock happened within a couple of days and I was able to use the ebay return policy.. I'm gonna pass this on to the dude who sold it to me as he got conned as well.. I verified the original RAC owner with RAC.. the device was purchased in Puerto Rico..
Cheers!

I'm trying to do same with V20 (us996) , but there is only one firmware avaliable :| no older or newer firmwares

Nothing seemed to happened after I tried to flash back to stock using either file. Do you know what I might have done wrong?
EDIT: It works now. Not sure what happened buy after my 7th attempt, the flash went smoothly and I was able to follows inaudible101 instruction to remove RAC lock. Thanks for the help!

inaudible101 said:
Hello,
I hope this post is not against the rules, but I believe I found out how to remove the Rent a Center tracking and locking software that I believe if from computrace that is installed on our devices. It acts like a root kit that automatically reinstalls itself and has a device administrator profile that you can not remove.
I think I figured out how to get rid of the RAC (rent a center) lock for good. The rac lock uses a system administrator profile along with a program called sec.abt that can not be removed or frozen. If you manage to uninstall it is just reinstalls itself. I was not able to find any information on how to remove this without using special hardware like an octopus box that costs hundreds of dollars.
I used LGUP with the uppercut modification (can be found here on XDA) along with the KDZ files from here https://lg-firmwares.com/lg-rs988-firmwares/
I was only able to find the USA RSS 11C firmware until I found the page linked above with the BPT 10D firmware. Whenever you flash the stock 11C USA firmware the RAC program comes back and once connected to the net will lock your device, however if you use LGUP and uppercut to flash the BPT 10D firmware using the upgrade option (refurbish will error out) I found that my device booted correctly and seemed to work, however I did not have any fastboot options and it said there were no updates available (you need fastboot to unlock the bootloader and the latest update grants that ability). I then reinstalled the USA 11C firmware and to my delight found that the RAC software and device administrator profile were gone.
I then checked for updates and it started download the latest update. I believe I will not have a problem unlocking the bootloader and rooting from this point on. I'll let you guys know if anything changes.
I'm only posting this because I have been sitting on a RAC locked phone for months that got locked over six months after I bought it used and really hope this can help someone else that got screwed over.
Click to expand...
Click to collapse
Hey bro, thanks for the input.
I know you're talking about LG G5 but Im exactly in the same situtation for an LG V20 us996(Unlocked version), I have kinda tried this but didnt work. Do you have any advice or any other thing to consider you could tell me so I try on my phne? I cant access the phone to activate usb debugging nor oem unlock
Thanks man!

I got USB debugging to turn on, but the settings close everytime I try to turn on the oem unlocking.
Sent from my LG-US996 using Tapatalk

ThaHaloMilitia said:
I got USB debugging to turn on, but the settings close everytime I try to turn on the oem unlocking.
Click to expand...
Click to collapse
If you go into safe mode you can turn on USB debug as well as enable OEM unlock. You can normally get into safe mode by holding power button like your going to shut it off only hold the power off till a screen pops up. Select turn on and phone will reboot into safe mode.

Recovery bricked after Nougat update?

First excuse me for opening an other thread like this, i think i have read all other threats regarding my problem, but none have the same situation
My Huawei M3 Wifi (BTV-W09) seems semi bricked after installation of Nougat Update.
The Installation (Force Install with dload) gave me an error and also while boot i got the error message: "Your device has failed verification and may not work properly."
I have the option to press "Powerbutton" and the device will boot up. I checked the Version and it showed android 7 + EMUI 5. The only problem was that almost every system app was missing, like keyboard, calendar etc. (playstore was there)
So i tried to do the rollback with:
HUAWEI MediaPad M3 8 Rollback Package%28BTV-W09 %2CC900B300%2C EMUI5.0%2BAndroid7.0 rollback to EMUI4.1%2BAndroid 6.0%29
The Installtion (force update) gets stuck at 5% and after like 3-5 minutes the tablet will boot up showing the same boot error that can be skipped with pressing powerbutton. I checked sytem and it still showed "android 7 + EMUI 5" but built : BTV-W09C900B300
I think this is the one i "need" to be able to install the "HUAWEI MediaPad M3 8 Firmware %28BTV-W09 %2CC100B006%2C EMUI4.1%2BAndroid 6.0%29"
Problem is regardless which "update.app" i try to force install will get stuck at 5% and give me same error. I have ADB/Fastboot installed and tried some different things like flashing/unbricking it with "Huawei Multitool" where you can extract like boot.img or recovery.img and try to flash it.
Also getting an error. I can access eRecovery witout problems, the option to fix it by itself by wifi doesn`t work. I can´t access "normal" recovery and i think there is the problem (may got bricked while flashing Nougat?) I think its recovery problem, cause when i boot it up to the "half-installed" Android and go into setting "hard-reset" option i know it would boot up intoi recovery and would erease everything, while bootup it shows error "reset failed".
In fastbootmode i see bootloader: unlocked FRM: unlocked
I tried to install TWRP recovery with adb but get error: adb remote command not allowed
I downloaded like 15 different Android Versions 6+7 Emui 4.1+5 to try with force update but none worked, may i have to flash special version of recovery first?
I just want a normal version of android 6 or 7 i dont mind but at the moment with half working 7 "without" systemapps its a hardtime.
I hope someone can help me.
This isnt my first android device and im not a total noob i unlocked bootloader and flashed kernels on many other phones but with the W-09 where i did nothing special i dont get why "recovery got broken"
Thanks in advance

You haven't read other threads too well: more times people reported that the bootloader got locked after an update still declaring itself unlocked!
Second thing you have not found: the Nougat update consist of 2 packages and the second must be installed from TWRP.

nicolap8 said:
You haven't read other threads too well: more times people reported that the bootloader got locked after an update still declaring itself unlocked!
Second thing you have not found: the Nougat update consist of 2 packages and the second must be installed from TWRP.
Click to expand...
Click to collapse
thanks for your anwser, i read that so i also tried unlocking it "again" and it quotet it is also unlocked in adb. I also know that there are 2 packages. That you need TWRP i didnt know thanks so i am a bit smater now. I think i ll try "relock" and unlock it again might be the right way, thanks for the tip.

kivi90 said:
I think i ll try "relock" and unlock it again might be the right way, thanks for the tip.
Click to expand...
Click to collapse
This is nonsense. Unlock, install the right TWRP then install the second zip package.

nicolap8 said:
This is nonsense. Unlock, install the right TWRP then install the second zip package.
Click to expand...
Click to collapse
i cant unlock cause i dont have the code, on the huawei page i try do make an account and get the code by providing the necessary information.
I just uploaded a picture, i choose "before EMUI5" cause this is the only option i can choose "tablets". --> i choose "tablet wifi" , enter product model "BTV-W09" then the serialnumber i can see in setting: 28D6R17316XXXXXX but then i have the problem to input product id, it say i can get it through "Dialer" app (which i dont have in wifi model ) or the calculator. Problem is in my damaged installation there is no huawei calc, other calcs from store dont work (read that problem in other threats) I tried many apps from appstore to get a product ID but huawei site keeps saying wrong product ID =/
With the program DC Unlocker i am able to see a MEID i dont know if its the right one, i tried my luck with the Product ID Generator from Huawei but it doenst work. (device not supported)

It's very strange that it says bootloader unlocked if you have never unlocked...
And was very stupid to try to installl a beta release without before unlocking and taking a backup.
Exhange your device for a Nokia 3110!

nicolap8 said:
It's very strange that it says bootloader unlocked if you have never unlocked...
And was very stupid to try to installl a beta release without before unlocking and taking a backup.
Exhange your device for a Nokia 3110!
Click to expand...
Click to collapse
yeah at this device i never touched bootloader, i didnt think it would become such a big deal , i didnt want unlocked bootloader or other recovery just newest android. Never had any problems with the "force update function" to come back to stock. I tried DC Unlocker but cant get further cause device need to get into manufature mode (thorugh dialer or calculator which i both dont have) i hope maybe i find one more way.

Did you ever find a fix
Did you ever find a way to fix this. I'm in the same situation. I even did a VPN on my router to give me a Hong Kong address for erecovery and that still didn't work. I have the exact same product. Like you I tried to various attempts to download a new recovery, but nothing works. Nice hardware, but some of the worst software/firmware I have ever dealt with since starting with the first release of Android on the HTC Hero.

kivi90 said:
yeah at this device i never touched bootloader, i didnt think it would become such a big deal , i didnt want unlocked bootloader or other recovery just newest android. Never had any problems with the "force update function" to come back to stock. I tried DC Unlocker but cant get further cause device need to get into manufature mode (thorugh dialer or calculator which i both dont have) i hope maybe i find one more way.
Click to expand...
Click to collapse
I had mostly the same problem. I rolled back to 4.1 using the rollback and the actual 4.1 update.app. I think that puts you on C100 if I remember right. Tablet I have is C128 (USA) but no problem for this step. Get the Product ID from the calculator. Allow OEM unlock in the settings, then unlock it using the unlock code. Email yourself the unlock code because who knows if their website will even be functional next time. Alternatively you can extract the stock calculator from the update_data_usa.zip or whatever and try to use DC with 5.0. That second update zip does not install properly via the dload method, so a bunch of stock apps don't get installed. You can kind of hack it and flash it via TWRP but I didn't do it that way.
Or...you can use firmware finder to force an OTA from 4.1 right up to 5.0 (350), then take that last partial OTA to 351 after as well. The way to do that is via DNS in firmware finder. Find the Full OTA in firmware finder you want, send it to the updater by changing your DNS the way it tells you to, and when it does the OTA, everything will be properly installed basically the official way. Good as new. Flash TWRP to recovery2 and replace the erecovery. Keep the stock recovery as is. Install magisk. Golden.
---------- Post added at 03:36 AM ---------- Previous post was at 03:26 AM ----------
kivi90 said:
So i tried to do the rollback with:
HUAWEI MediaPad M3 8 Rollback Package%28BTV-W09 %2CC900B300%2C EMUI5.0%2BAndroid7.0 rollback to EMUI4.1%2BAndroid 6.0%29
The Installtion (force update) gets stuck at 5% and after like 3-5 minutes the tablet will boot up showing the same boot error that can be skipped with pressing powerbutton. I checked sytem and it still showed "android 7 + EMUI 5" but built : BTV-W09C900B300
I think this is the one i "need" to be able to install the "HUAWEI MediaPad M3 8 Firmware %28BTV-W09 %2CC100B006%2C EMUI4.1%2BAndroid 6.0%29"
Problem is regardless which "update.app" i try to force install will get stuck at 5% and give me same error.
Click to expand...
Click to collapse
Also, as far as the rollback, you need to do the first one (the C900 which is just a compatibility fix to allow rollback, previously used by beta testers I believe). Then you need to do the second one, the C100. If it is getting stuck, try downloading it again and be sure you don't have anything else in the /dload directory on either internal or the sd card. I had one on both at one point so maybe that happened to you. The C900 should be very quick but the C100 will slowly progress after 5% all the way around in several minutes.
When you get to updating back to 5.0, you can choose whichever region you want as long as it is a full OTA. C128 is USA and that's what I bought so that's what I picked. That gets you back in the right OTA update channel after that.

Hi guys,
I started as a novice and have learnt the hard way.
Has anyone tried rollback to EMUI 4.1 EU version on a US device (W09) and are there any problems I should be aware of?
I have had the exact same problem shared in this thread and have gone through the pain of finding a solution. My last resort is to rollback to 4.1 and restart the whole process.
@deV14nt: you suggested that when updating back to EMUI 5.0, I can choose the region even if my EMUI4.1 is EU version. How does this work?
Thanks in advance for your help.

[H918] Successful root/fastboot unlock from 10J -> No roms are flashed successfully

[H918] Successful root/fastboot unlock from 10J -> No roms are flashed successfully
Hi folks, wanted to share my current state of affairs with trying (and failing) to install a new rom on my LG V2O. Here's the order of events
Received brand new sealed-in-box LG V20 from T-Mobile from a third party seller that came in firmware 10J
Followed all directions to successfully perform dirtycow unlock
Installed TWRP (3.0.2-1)
Backed up, but mistakenly deleted the backup after trying to install Megarom in an attempt to do a clean flash
.zip flashed correctly, but hits boot loop upon reaching LG screen (even after waiting 20+ minutes on first boot). T-mobile screen never pops up
Can access TWRP still and ADB commands
Basically now, I've tried looking at as many H918 rom threads as I could but every single rom I try either: never completes flashing OR if it does complete flashing, the device never boots (either bootloop or stuck on the LG screen). I've never seen the device get past the LG screen for any reason. I am desperate for help on this matter as I have royally screwed up trying to provide a nice gift for my partner but was apparently way in over my head with trying to get a fresh rom on this thing.
Can anyone provide assistance as to how I can roll back to a stock rom? I'd be willing to give up root/recovery. All of this was spawned from wanting to be able to unlock the carrier but I have decided I'll just pay for the sim-unlock service if I can get this back to stock. Would be willing to provide some PayPal cash for someone who can help me out with this matter.

Flash to 10j kdz firmware located in the thread with all the firmwares. You`ll need lgup to flash it.
https://forum.xda-developers.com/v20/how-to/restore-v20-to-100-stock-bricked-devices-t3524903
https://forum.xda-developers.com/v20/how-to/t-mobile-lgv20-h91810j-kdz-t3540747

So how badly i bricked LG V20 LS997?

I got LS997 that was not completely unlocked (Sprint support confirms unlock status but phone did not receive unlock command, and i got no sim card and no previous owners name to re-initiate ota-unlocking process)
First thing i did - i used pathed LGUP and dirtysanta rooted my phone.
Suggested 995 kdz rom was vibrating like crazy (as described in dirtysanta guide) but i got root and started experimenting further.
Than i flashed rootable 996 kdz, rooted, had no vibration problem but got static boot issue, ok, installed mk2000 kernel, no static - all good but still not enough.
LOS16 = gsm/lte unlocked but battery was drained in 5 hours with screen turned off and no camera, got back to 996, rooted, super rom, all good but LTE not operating for some reason. Really enjoyed stock functionality (camera, seconds screen) and decided to get back to stock system.
HOWTO: Root LS997 up to ZV7, did it all, started flashing available 'stockish' roms one by one [this, and this], so there goes bad stuff.
At this moment i was still being able to boot into twrp, so i didn't really notice that phone was bricked, those stockish systems was just hanging in LG logo for hours without any progress. ok, found another one stock ls997 rom in dirtysanta root post, flashed it - and nothing, phone still stuck at lg logo.
LGUP flashing routine that was always helping me recover, now if fully completes partition_dl process but results are the same - lg logo for hours without anything happening, except vibrator motor starting to work on power up on Verizon firmware version and no vibro on 996 variant (as it sould):
996 kdz - stuck on logo
996 kdz- stuck on logo
flashing everything i got from lg-firmwares.com:
US99610g_00_1216 - stuck on logo
US99610f_00_1205 - stuck on logo
US99620f_00_1120 android 8.0 - stuck on logo
VS99512A_06_1114_ARB00 - stuck on logo
download couple more variants and still nothing, phone stucking in lg logo
so how badly i bricked it? is there any method of recovering that i am not aware of?

There is an older thread on returning the LS997 back to stock that may help.

C D said:
There is an older thread on returning the LS997 back to stock that may help.
Click to expand...
Click to collapse
Yeah, thanks, been there.
Unfortunately i'm not meeting 2 of 3 prerequisites:
- Your device needs to be able to boot into TWRP and fastboot mode
- You need access to a computer to run ADB commands to the phone
There are no more twrp presents on device because of kdz uploads from LGUP, i was thinking that it was recovery and aboot partitions that was messing up my system.
And there is no bootable system on device to turn on usb debbuging to run ADB commands as only thing i get is boot logo, fastboot are also locked to 995 or 996 (whatever version i've uploaded last from LGUP, and they are not unlockable because LG recognizes original LS997 hardware identification and refuses to give me unlock.img.
As i get it - the only thing that can tinker with my device is something that can get same hardware access as LGUP (laf is still operational or idk, maybe not, but it should be getting everything up and running but that is not the case anymore for some reason)

So you are saying that LGUP can still see the phone but ADB can't. Did you by any chance do a full system dump of the phone on LGUP before the whole DirtySanta procedure in the beginning? I wonder if those files can help getting things back on track. Not sure if they are device-specific, but I did make a dump of my own LS997, so if you think there's something useful there, let me know, and I can upload the files somewhere.

C D said:
So you are saying that LGUP can still see the phone but ADB can't. Did you by any chance do a full system dump of the phone on LGUP before the whole DirtySanta procedure in the beginning? I wonder if those files can help getting things back on track. Not sure if they are device-specific, but I did make a dump of my own LS997, so if you think there's something useful there, let me know, and I can upload the files somewhere.
Click to expand...
Click to collapse
Yes i did full LGUP backup at first system state, but nature of this backups makes them pretty useless in this system state - because they are just images of partitions.
Only software that can write directly to those partition may be able to utilize those backups, there are a lot of post on this forum describing TWRP routine for making update packages based on LGUP backups.
So unfortunately there is only LGUP, but it only can make backups but can not restore them as it uses some special file format (KDZ) that containing some dll's and data files (like glued partition images with special info of where to put what) and i didn't find a way to make my own KDZ files from backup images.
I'm now getting another idea - that this can be a blowed fuse in CPU ARB protection mechanism, if anyone has experienced ARB 1 please confirm that system should be in this state in case of ARB error

[LG-H872]LG G6 Bricked/Stuck in DL Mode

Hello XDA. I recently revived my G6 after it sat in my drawer for years and was delighted to see HavocOS on Oreo still running on it. I popped in my T-Mobile SIM and voila, service. My only issue was horrible data speeds. I tried every network settings and apn fix that is relevant to my device but I was still stuck with virtually no 4G data. So, my last resort was to flash back to stock. Now, I dont know if there is a specific method for this device as I forgot how complicated the root exploit was. But I went ahead and downloaded the latest stock .kdz (20g), LGUP and the drivers and proceeded as normal to flash the kdz over. I had SEVERAL issues getting my device model to be recognized and finally grabbed the right LGUP version that worked. I proceeded to flash the kdz when it gave me an error round 31%. I did much troubleshooting research and came up empty, finally decided to try flashing the stock version it was on (20a) to just restore it.
This worked. I thought I was saved until the phone froze on the T-Mobile logo while booting and didnt budge for an hour. Much more googling and I found a thread that looked promising and seemed to help. At first. It flashed the kdz, gave me the error, and when I tried to flash the dz, nothing. I retried LGUP with 20a stock, unknown model. I tried to go back through the whole rooting process again and stick it out with minimal service. The FWUL/lglaf portion of the guide is where I got stuck. My device would not be recognized in FWUL, I couldnt get wifi so plugged in my ethernet. And then I kept getting "USB configuration not set" and "input/output" errors, and I noticed that while booting FWUL, the step "Loading Kernel Modules" fails. So I assumed that FWUL was not loading any modules, including USB's (which explained the errors), so I booted up my own Manjaro install and cloned the same project there. Knowing all my modules work now, I still get the "Input/Output" error.
So now I'm led to believe this phone is hard-bricked. It registers as a port in Window's Device Manager, "LG AndroidUSB SerialNet" or something like that. I tried following the unknown model guide again to no avail. I'm at a loss. Whatever info is needed for debugging I'll provide. I'm dualbooting Win10 and Manjaro so any methods are viable.

Which specific stock KDZ(s) did you try to flash on your phone (full kdz name)? You need to seperate flashing and rooting as two separate tasks because from your post I can't tell if you are able to boot after flashing stock kdz or not. First, if your phone is not booting, you gotta recover from that and flash a stock kdz.
Also, try using the Dev patched LG UP from this post (thank the dev while you are there): https://forum.xda-developers.com/lg...ssflashing-t3780969/post76510671#post76510671
Try the 'Partition DL' option when you flash and select all partitions in the next window.
Once you are able to boot a stock rom, you can try using a VMWare such as virtual box, install/mount FWUL in a virtual environment and use that to root the phone. I think the process is somewhere here on the runningnak3d's guide or on another post, I will try find a link later.