Today, if you pick up a used LG G4 from eBay, the first question you must ask is not "Does it have a leather back?" but "Has the bootloader been unlocked?" If the answer is no, the phone is already dead. It just doesn’t know it yet.
By sending a specific malformed fastboot oem command (or using a low-level tool called LGLAF via Download Mode), the exploit flipped the UNLOCK bit. However, because LG signed the entire boot chain, simply flipping the bit wasn't enough—the phone would still refuse to boot an unsigned kernel.
The UsU exploit turned a disposable carrier brick into a community-maintained device. It allowed the G4 to outlive its manufacturer by four years. But it also highlighted a grim reality: If a company wants to lock you out, they will. The only reason the G4 was unlocked was due to a Qualcomm security hole and the relentless obsession of a few developers (steadfasterX, toughnight, and the XDA forums).
UsU was not a software toggle; it was a hardware-level exploit that targeted the . By manipulating the low-level partition table (sbl1, aboot), developers discovered they could set a "security flag" to 0 (unlocked), effectively permanently converting any LG G4 variant—even the dreaded AT&T H810—into a developer unit.
The LG G4 is infamous for the . Due to poor soldering on the motherboard (Snapdragon 808), the CPU would detach from the PCB over time. The phone would freeze, reboot, and get stuck on the LG logo forever.
The lock resides in the (Qualcomm Fuse Prom) at a specific address. The UsU exploit worked by exploiting a vulnerability in the SBL (Secondary Bootloader) that allowed arbitrary writes to the QFPROM.
But underneath the removable backplate lay a war. A war between the user’s right to own their device and the manufacturer’s desire for control. At the center of this conflict was a single, elusive gatekeeper:
For the community, this was the Rosetta Stone. Suddenly, the LG G4 became a universal device. You could flash the H815 LineageOS 18.1 (Android 11) onto a Verizon VS986. There is a morbid irony to the LG G4 bootloader unlocking saga. The primary reason users wanted to unlock the bootloader in 2016-2017 was not to run Linux or overclock the GPU. It was to stop the phone from killing itself .
PBL (Primary Bootloader - ROM) -> SBL (Secondary Bootloader) -> ABOOT (Android Bootloader) -> Boot Image -> System
