LG G4 Stylus (LG-H540) — MT6592M Unbrick, DA Protocol & LK Disassembly

The LG G4 Stylus (LG-H540) arrived as a bricked MediaTek MT6592M board displaying Security Error: Authentication Fail #9 and immediately powering off. Standard tools failed: LG's Download Mode (laf) was unreachable, and upstream mtkclient crashed when attempting to write partitions on the legacy MT6592 Download Agent (DA).

To recover the board, we extracted the official LG .kdz firmware (H54010d_00), backed up the factory calibration partitions (nvram, pro_info, protect_f, seccfg), reverse-engineered the MediaTek DA Stage 2 binary write protocol (0x61) to build a custom Python flasher (unbrick_flash.py), and flashed all 16 firmware partitions. We then disassembled the ARM Thumb-2 Little Kernel (lk.bin) bootloader in radare2 to identify the exact ADC and power-key checks causing batteryless shutdowns.

Hardware & Firmware Specifications

Subsystem & Recovery Status

Phase 1: Capturing the Custom LG Preloader (1004:61f1)

Unlike generic MediaTek devices (0e8d:2000), the LG-H540 enumerates with LG's vendor ID 1004:61f1 for ~2 seconds on USB insertion before dropping out. By adding a dedicated udev rule binding 1004:61f1 to the option / cdc_acm serial driver and suppressing ModemManager (ENV{ID_MM_DEVICE_IGNORE}="1"), mtkclient caught the Preloader handshake and uploaded the MT6592 Download Agent (MTK_AllInOne_DA.bin).

Before modifying flash, we dumped the board-unique calibration partitions:

• nvram.bin (5 MB @ 0x01880000)
• pro_info.bin (3 MB @ 0x01580000)
• protect_f.bin & protect_s.bin (10 MB each)
• seccfg.bin (128 KB @ 0x02d80000)

Phase 2: Reverse-Engineering the MT6592 DA Stage 2 Write Protocol

While mtkclient could read partitions on MT6592, every write command (mtk w / mtk wl) failed immediately because mtkclient's legacy mtk_dalegacy.py calls sdmmc_write_data(), which sends a raw 0x60 command without the Stage 2 framing expected by the MT6592 Download Agent binary.

By disassembling the MT6592 Stage 2 DA blob inside MTK_AllInOne_DA.bin, we reconstructed the exact wire protocol for SDMMC_WRITE_IMAGE_CMD (0x61):

Host                                      MT6592 DA Stage 2
 │                                               │
 ├── 0x61 (SDMMC_WRITE_IMAGE_CMD) ──────────────►│
 │   + [0x00] (1B storage_type = EMMC)           │
 │   + [0x08] (1B part_type = EMMC_PART_USER)    │
 │   + [addr] (8B big-endian byte offset)        │
 │   + [len]  (8B big-endian byte length)        │
 │   + [0x00100000] (4B packet_length = 1 MiB)   │
 │   + 14 bytes zero padding (36-byte header)    │
 │◄── 0x5A (ACK) ────────────────────────────────┤
 │                                               │
 ├── 0x62 (SDMMC_WRITE_DATA_CMD) ───────────────►│
 │   Loop for each 1 MiB chunk:                  │
 │   ├──◄ 0x69 (CONT_CHAR ready signal) ─────────┤
 │   ├──► [1 MiB raw payload in 4 KB USB writes] │
 │   ├──► [2B big-endian 16-bit word checksum]   │
 │   └──◄ 0x69 (Chunk verified & committed) ─────┤
 │                                               │
 │◄── 0x5A (ACK) + 0x5A (Post-sync ACK) ─────────┤

Using our custom flasher (unbrick_flash.py), we flashed all 16 KDZ partitions (MBR, EBR1, EBR2, uboot/lk.bin, boot.img, recovery.img, secro.img, logo.bin, cust.img, cache.img, system.img). Flashing secro.img (SEC_RO at 0x04980000) permanently cleared Security Error: Authentication Fail #9.

Phase 3: Disassembling lk.bin to Diagnose Batteryless KPOC Shutdown

After clearing the security error, plugging the bare board into USB without a battery caused it to vibrate, display the LG boot logo, and shut down a few seconds later. Disassembling uboot_393216.bin (lk.bin, loaded at 0x81E00000) in radare2 revealed two sequential power-off triggers in LG's customized Little Kernel:

1. KPOC (Kernel Power Off Charging) Mode: When USB VBUS is inserted without the power key held continuously, boot_mode_select() (0x81E0E000) logs "Power Off Charging Mode, Check Power Key" and sets g_boot_mode = 8 (KERNEL_POWER_OFF_CHARGING_BOOT). If the power key is released during KPOC init, it logs "PowerKey is released before display chargerlogo : Power Off!!" and halts the PMIC.
2. LG Battery Manager ([LGBM]) NTC Check: Inside mt65xx_bat_init() (0x81E0B6F8), the bootloader reads the battery ID and NTC thermistor via PMIC AUXADC. Without a battery connected, it hits "[LGBM] battery temperature ADC read fail,retry count = %d\n" five times, declares "BATTERY OVER TEMPERATURE Or FAIL Reading Battery Temperature", and calls mt6575_power_off().

Read the full protocol breakdown and annotated Thumb-2 disassembly in the companion blog post: Unbricking an LG G4 Stylus (MT6592M): Reverse-Engineering MediaTek's DA Write Protocol & Disassembling Little Kernel.

Device Tags: