yashsingh1/xdaforums huggingface dataset:
[LG Revolution] thecubed:
Also, download mode may not be fastboot-- LG may have their own service tools (think something like RUU for HTC, or Odin for Samsung).

That would be your all-else-fails recovery: plug in through USB and download the firmware right back to the device. I think as long as P1 and P2 (and the other random config partitions) are still in good condition, you should be able to use LG's service tools to restore the phone to defaults.

Also-- regarding P8: the dump you provided shows that it's empty... try increasing the "-n" parameter on hexdump to see if any data shows up.. there may be a large header on it.

I'm wondering why there would be such a large empty partition on the phone... (either that or it's read protected from within Android.. possibly something like the NAND security on HTC devices.)
[LG Revolution] majorpay:
ygpm

/10chars
[LG Revolution] majorpay:
Alright, I increased it to 10000 (just to make sure):

hexdump -n 10000 mmcblk0p8
0000000 0000 0000 0000 0000 0000 0000 0000 0000
*
0000440 ffff ffff ffff ffff ffff ffff ffff ffff
*
0001000 4146 5443 525f 5345 5445 365f ff0a ffff
0001010 ffff ffff ffff ffff ffff ffff ffff ffff
*
0001800 4944 4d45 4944 4d45 8280 4403 0000 0099
0001810 ffff ffff ffff ffff ffff ffff ffff ffff
*
0002710

Would be nice to have full access to that emergency recovery utility. Always nice to have a backup, but if we get this one built, we'll be golden! I know everyone's been holding their breath waiting for the recovery before they start working on ROMs.
[LG Revolution] majorpay:
I'm in the middle of pulling the CyanogenMod repository. Looks like it will take forever, so I'm just going to let it run. This should put us in a good place when we decide to build the recovery, unless you were planning to run the build.

I'm curious what the risk factor will be once completed for pushing it? Any way to run a *relatively* harmless test, or is this supposedly a slam dunk thing?

If not, and it bricks, I'll have to accidentally back over it with my car :eek:
[LG Revolution] smokedkill:
You guys should talk to punk.kaos. He has been developing roms for a few years and told me that while he has no plans on developing for the Revolution, he would be glad to help if you guys need any help.

I appreciate the effort you guys are putting into this. I wish I was able to help, but maybe punk.kaos can give you some useful advice. I am willing to donate to coffee funds though if anyone who is attempting on creating a rom has a PayPal.
[LG Revolution] clabr20:
Keep it going. Im up and following, anything or any assistance let me know.
[LG Revolution] majorpay:
Yeah, I'm familiar with Kaos' work (I'm an Eris defector). I'll keep him in mind if we hit a roadblock.

The ROMs and developers should come if we can accomplish this. The developers won't develop if a recovery isn't in place, and the problem is that they aren't standard across the board, which is why we have 3 pages of poking. IF this gets completed, the floodgates for cooking will be open!

And a BIG thanks goes out to cubed. He's my new hero :D
[LG Revolution] thecubed:
Looks like mmcblk0p8 is the extended partition, so it's like the wrapper for the other partitions...

As a nondestructive way of testing CWM, we can enable ADB and push over CWM binaries and test them without permanently modifying the actual files.

The only thing I'm not 100% on yet is how exactly to do that without modifying the recovery partiton...

if you can post the dumps of those two partitions somewhere, I can see if they're signed and look into any possibilities for enabling ADB without modifying anything permanently.
[LG Revolution] majorpay:
Sounds good. Whatever we have to do to get there is fine (even if it means a certain degree of risk). I wish they had a way to convert a phone into an AVD, but from what I've seen, that doesn't appear to be possible.

I've sent you a link for all my dumps.

ygpm
[LG Revolution] thecubed:
Excellent, I'm going to dump the p9 files and see whats going on. There is a possibility that we'll find some interesting things on it. (personally I'm hoping to see that the partition isn't signed and ADB is enabled by just putting a file in /cache, but those are probably just dreams... except the signing part.)
[LG Revolution] thecubed:
Quick update:

Looks like I may have a few things sorted out as for what the mmcblk0pX map to...

179 1 2048 mmcblk0p1	HBOOT (just what I'm calling it until I know what the LG equivalent is)
179 2 2048 mmcblk0p2	XLOADER (same as above -- but this looks like it chainloads Android or WM)
179 3 7168 mmcblk0p3	AMSS?
179 4 1 mmcblk0p4
179 5 28672 mmcblk0p5	/persist
179 6 204800 mmcblk0p6	/cache
179 7 4096 mmcblk0p7
179 8 24576 mmcblk0p8	*Extended Partition*
179 9 8192 mmcblk0p9	Fastboot image: boot.img (contains a full init.rc for starting Android, and charger images)
179 10 4096 mmcblk0p10
179 11 4096 mmcblk0p11
179 12 1024000 mmcblk0p12	/system
179 13 1572864 mmcblk0p13	/data
179 14 12288 mmcblk0p14	Fastboot image: recovery.img
179 15 12599296 mmcblk0p15	/sdcard -- internal storage

This is subject to change, and I think I've got a few things wrong (mostly pertaining to AMSS and bootloader-related things), but for what we're interested in (recovery.img) I think I'm spot on.

From what I've seen inside the p9 image, I don't see any sort of signature or checksum anywhere... however, I'm not sure if it's stored in any of the other partitions just quite yet.

I'm actually pretty new to Qualcomm style devices, I've always worked with OMAP (specifically the n900 and NookColor), so it may take me a little while to determine whether it's safe or not to flash any fastboot images without risking a brick.

What I am working on right now is p14 (recovery) to see if there is a way to enable ADB so that we can try Clockwork nondestructively.

Work goes on! :)

EDIT: something I just thought of-- why would p9 have no 'toolbox' binary? There doesn't seem to even be a /sbin/sh! Possibly something I'm missing here...

I'm trying to get p14's ramdisk to extract right now... my hex editing skills are at a bit of a loss.. the gzip archive doesn't seem to want to extract... ugh.
[LG Revolution] thecubed:
Grr.. working on P14 seems to be hitting a roadblock for the moment.. I'm not sure what's happening but I get what looks like a complete gzip header (1f 8b) then the gzip'd data then the trailing 00 00 00 's.

Sounds normal? Strip the trailing zeroes, save to file. Great! Opens with winRAR/7zip, but the file doesn't extract. I get about 404KB extracted before I get a CRC error or a "format violated" error in gzip in linux.

There's something I'm missing... and I'm not sure what it is just yet.

Here's a quick something to test: boot into Android Recovery on the device and plug in to USB. See what devices manifest themselves... If you get an ADB device, GREAT!

Side note: my friend really needs to get one of these soon. I was in the VZW store today running quadrant on the 4G devices-- despite the Revolution having only 384MB ram, it scored pretty high on Quadrant compared to the thunderbolt and droid charge. However, both of these phones are 2.2 while his droidX is 2.3, and scored within a few points of the Revolution... I wonder how this phone will be with 2.3 :)
[LG Revolution] gimpcell:
My heart almost jumped out of my chest when a flickering screen is what I saw after a reboot. Thank those the bootloader is unlocked... Sheesh!:-)

Sent from my VS910 4G
[LG Revolution] majorpay:
I have a thought on the corruption. Perhaps it is due to the way that I transferred it. I really wasn't paying attention when I transferred from Linux to Windows and perhaps the transfer was an ASCII transfer which would explain the problem. I can try to upload again, ensuring a binary transfer and see if that doesn't help you out.

As far as the scoring of the Revolution, I couldn't tell you. Google's initial claim was that Gingerbread was supposed to increase speed. And 384mb of RAM?? That made me actually look, and sure enough... I didn't think they were pushing any phones these days short of 512! All the press releases were claiming 768 to 1024 and even the Verizon website itself was claiming 768!
[LG Revolution] majorpay:
I re-uploaded with "force utf-8" enabled. If this doesn't give us any luck, I'll have to switch over to my linux server for FTP support (not a terrible thing, just have to reconfigure the router and install an FTP server.

If at that point, you still can't open the files, then I'm not sure, but I guess we'll cross that bridge. Here's hoping plan 'A' or plan 'B' works.
[LG Revolution] stetsonaw:
Download xUltimate 2.2.5 (newly added Revo support)

Revo System Dump

(Block the extracted folder from your Virus Protection)

Open xUltimate.exe via command prompt, "main /skip". This will ensure you don't need to have the phone hooked up.

Drop the Framework files from the dump into the Orig_Frame folder, and the System/app apks into the Orig_App folder.

Go back to xUltimate, run option 3 to do the apps, wait.

When complete, run option 4, wait.

When complete, go to the Orig_App and Orig_Frame folders and delete the .odex files. Then copy all files from the Done_App to Orig_App (because some files didn't need odexed, they remain in the Orig_App folder. Do the same thing with the files from Done_Frame to Orig_Frame. Now you can drop these all back in their respective folders in the dump.

Oh, and i'm not a ROM dev, wish I was, but i'm just a themer. That and I don't own the Revo anymore, i bailed, as there was no work being done on this last week.

But a BIG THANK YOU for working on this dude!! may talk to _mrbirdman_on twitter (forget what his name is on here). He worked on this for about a day, pushed a custom recovery and bricked his phone. Just to make sure you don't do the same thing as him.
[LG Revolution] majorpay:
Wow, thanks, and thanks for the heads up. I definitely don't want to do the bricking thing if I can avoid it. I'll give him a shout and see what he did.
[LG Revolution] bwhxeon:
I'm thinking the 384mb of ram is a similar condition to the samsung phones. The galaxy phones are advertised with 528mb but only provide access to 384mb, supposedly its because the rest of the ram is allocated to the gpu and parts of die. I remember reading somewhere that the revolution has the radio and other fucntions all included on the same chip. Hense the pcb size difference compared to the thunderbolt, course that could just be the extra radio included in the thunderbolt
[LG Revolution] thecubed:
Just redownloaded the mmcblk0p14 dump, and it's identical to what I downloaded earlier.

I just saw a video on youtube of the Revolution's supposed "recovery menu", which looks suspicious. (http://youtube.com/watch?v=SH-ZQmi3_A0)

It shows something VERY low resolution and all text--nothing like even the stock recovery software. Weird.

But then it shows the stock Android recovery doing it's thing on second reboot (the android coming out of the box is the stock Android recovery image when restoring the device)

What I'm getting at is that I'm confused as to why LG would put in a layer between the real recovery and the user.

Either way, I still need to figure out what's in mmcblk0p14. If we have a full recovery binary, it may be possible to still make this work--although hearing of mrbirdman's brickage by pushing a new recovery is slightly disheartening. (although, I have no idea what he tried-- he may have not even pushed it to the right mmcblk location, or have the right kernel)
[LG Revolution] thecubed:
The thunderbolt I tested in the VZW store also had somewhere in the vicinity of 390MB RAM accessible to Android.

This is possibly due to the radio and applications processor sharing the same RAM.

I suspect most phones using this CPU and LTE baseband will have similar RAM configurations, although it is strange that they advertised this as having more RAM.
[LG Revolution] bwhxeon:
I'm not really surpised, verizon's developing some odd trends when it comes to its phones. I'm still purplexed by the difference in quadrant scores. The benchmark runs at the native resolution witch is 30% higher on the droid x2 so that explains its low score for a dual core phone. Its the difference when compared to the thunderbolt that has me really perplexed. The revolution clearly has more bloatware installed so the score should be lower not higher.

The only other thing that I can think of is the internal memory difference. I'm thinking the IO score is being inflated which is the usual way people manipulate their quadrant scores. Running both phones on quadrant pro should be able to confirm this.
[LG Revolution] majorpay:
Well, I'm stuck at work and can't test this, but I found some interesting (odd) behavior with this unit. If you can get the phone to go into battery charge mode (flashing battery symbol), Windows will recognize the device and associate the drivers with it. I can't test this at the moment, but if the drivers are activated before boot, there should be a way to access this. Could it be through fastboot? I don't know, and it's killing me that I can't test it.

Anyhow, did you get the dumps again, and did that change in transfer method help you?

As far as RAM is concerned, it's about hype. If you, for some reason, purchase a PC with shared video RAM, they still advertise it as having the full amount of memory, even though you are docked for your GPU.
[LG Revolution] thecubed:
Yep, I redownloaded the dump of p14, and it's exactly the same.

Check my post on page 4, I posted twice so you may have missed it...
[LG Revolution] stetsonaw:
LOL, that's why i posted the vid, so people could see how LG did this. With it being that way, it shows that there is a real recovery mode, just LG masked it with a shortcut.
[LG Revolution] thecubed:
What button combinations did you try to get into recovery? (VOLUP+PWR, VOLDWN+PWR)

I'm not sure if the capacitive buttons are checked on boot (they aren't on any phone I know of that has them), I think it'd be safe to say it's nothing like HOME+PWR or SEARCH+PWR.

The interesting thing here is that LG doesn't have any other Snapdragon phones similar to this one. Everything I've seen from LG is either Tegra2 or OMAP in the recent phones. Each phone seems to have its own firmware loading interface, like the G2x has nvflash from nVidia. What does ours use?

Can anyone find the stock firmware from LG? It may be of use to discover how it works, and possibly extract the dumps right from the update package.
[LG Revolution] majorpay:
Well, the good news is (I guess), is I downloaded the file myself and executed:

cmp -l mmcblk0p14 mmcblk0p14.img

and I got pages of crap indicating that these two files from a binary standpoint aren't even close to being the same. I'll do some testing until I can get my download to match the original and let you know when I'm successful.
[LG Revolution] thecubed:
Sent you a PM, just SCP the mmcblk0p14 to my server...
[LG Revolution] majorpay:
OK, I figured it out, did a download and compare, and no differences this time! (sorry about all that... Linux to Windows crap and all). Use the FTP link I sent you and those should be the exact replicas. Just remember to do your transfers in binary (I assume you are on Linux, so that shouldn't be an issue :D ).

Maybe if you ever send me back anything, we should send a control file to ensure no encoding happened along the way. Even the tiniest hiccup like that could cause a full brick.
[LG Revolution] thecubed:
Yep, that's what MD5 is for (just do a md5sum on the file-- you can even md5sum a bunch of files at once in linux)

I'm redownloading from your server now...
[LG Revolution] thecubed:
Worked!

I've got a dump of recovery!

P14 is indeed /recovery :)

We've got a /sbin/recovery and /sbin/adbd...

but adbd is set by default.prop to off...

So, looks like we'll need to push a custom recovery to do anything at this point since the safest route (changing files in RAM only while booted into recovery) isn't available.

If we could find out if this phone supports fastboot, we could attempt just booting a modified recovery image rather than flashing it.

Things to do next:

1) Find out how to directly access recovery without LG's weird intermediary

2) Find fastboot mode

3) Find original firmware, just incase :)

4) Boot (or flash if we don't have fastboot to test) a modified recovery with JUST adb enabled

5) Build CWM and try via adb

6) Profit! (haha)

EDIT: attached is the CPIO archive I got from the recovery partition, just incase anyone wants it.

EDIT2: looks like they're not using the test keys either, so recovery expects signed .zips (that's not to say recovery itself is signed, which I have no idea at this point in time).
[LG Revolution] majorpay:
That's good news! I don't know about the profit part, but as far as directly accessing recovery is concerned, there really isn't a whole lot of options in the device's current state. We have three active buttons at power on, and I'd suspect I've messed with them all (can't guarantee that, but likely).

At this point, I'm starting to look at the pinholes - ha! (one on the bottom, one on the back)
[LG Revolution] thecubed:
Can you pastebin the DMESG from boot somewhere?

I think I have an idea as to what p8 is.. it's not the extended partition :)

Looks like a control block for something...

Also, after redownloading the dumps of p1 and p2, it looks like there's nothing there that checks for signatures of fastboot images...

But curiously I see no references to fastboot in the strings anywhere, but p2 definitely looks for the fastboot header "ANDROID!", so p2 may be LG's implementation of fastboot.

Anyway, the three most helpful things now would be:

1) the dmesg

2) an explanation of what the device does when VOLUP+PWR, or VOLDN+PWR are held on boot (and what devices show up on USB)

3) the factory firmware (...still can't find it...)

Great work!
[LG Revolution] stetsonaw:
I figure you guys are already working with this, but for anyone who wants to get an idea of what this takes...

Porting Clockwork Recovery to New Devices by Koush
[LG Revolution] stetsonaw:
VOLDN+PWR are to get into the "Factory Reset Mode" like in the video, Never checked to see what VOLUP+PWR did, or a combination of VOLUP+VOLDN+PWR.
[LG Revolution] thecubed:
Yep, I've been through all this once before with the NookColor (although I was just watching-- you pick up a LOT from listening :) )

I'm thinking this is going to be a slam dunk here soon...
[LG Revolution] stetsonaw:
If so, I may have to take my bolt back and get the revo again. will make my 3rd, lol.
[LG Revolution] thecubed:
Okay, well I'm heading out for a while. I'll be back around 9PM Pacific time.

I think tonight, if anyone's willing, I'll make a recovery.img with adb support, and see if anyone wants to try it :)
[LG Revolution] majorpay:
I guess you could hit me up. What degree of certainty are we talking here at this point? It's not so much the degree of certainty that it won't brick, but rather that we can recover it (lol).

I can still get you the dmesg later tonight, but I'm not allowed to access my phone on the pc I'm on (gvmt regs).

I get notifications here, so shoot me a PM or post in here and we'll see how it goes.

BTW -IRC: I tried to get my damn phone to connect, but it kept giving me crap about the SASL failing.
[LG Revolution] thecubed:
The degree of certainty isn't anything like 90%, but more like 55% :)

We're not replacing the normal android boot, but the recovery process.

I think that if we mess up recovery, the system should still boot normally and allow us to put the original dump back.

But yeah, I would like some failsafe too-- hence the need for the LG firmware files...

Anyway, I'll talk to y'all later tonight.

Great work, as usual.
[LG Revolution] brdc2190:
I am willing to give it a go tonight when I get home.
[LG Revolution] kraamerica:
stetson, picked one up today. I let the VZW manager talk me in to it. He has a TB. I've been watching this thread and these 2 guys.
[LG Revolution] stetsonaw:
picked up a Revo?
[LG Revolution] kraamerica:
Yeah, sorry. Tried to edit but being a lurker not a poster had me waiting 5 minutes per XDA spam rules. :)
[LG Revolution] juicehead9:
Im in to help in anyway i can. you guys rock!
[LG Revolution] thecubed:
Can anyone pastebin a dmesg for me?

I've got an updated partition list, but I'd like to see if there's anything helpful in dmesg since I don't actually have this phone...

179 1 2048 mmcblk0p1	First stage bootloader
179 2 2048 mmcblk0p2	Second stage bootloader
179 3 7168 mmcblk0p3	Blank (possibly blocked by radio)
179 4 1 mmcblk0p4	Empty. 1KB in size.
179 5 28672 mmcblk0p5	/persist
179 6 204800 mmcblk0p6	/cache
179 7 4096 mmcblk0p7	Blank (possibly blocked by radio)
179 8 24576 mmcblk0p8	Bootloader control block (normally contains 'FACT_RESET_6')
179 9 8192 mmcblk0p9	Fastboot image: boot.img
179 10 4096 mmcblk0p10	Unknown - Possibly radio configuration
179 11 4096 mmcblk0p11	Unknown - Possibly radio configuration (p10 and p11 are not identical)
179 12 1024000 mmcblk0p12	/system
179 13 1572864 mmcblk0p13	/data
179 14 12288 mmcblk0p14	Fastboot image: recovery.img
179 15 12599296 mmcblk0p15	/sdcard -- internal storage

Also, here's my theory of operation for how recovery will work:

Theory of operation:

1)	device booted with volume button + power
loads into LG Factory Reset

2)	user confirms 'factory reset'

3)	LG Factory Reset writes to mmcblk0p8, 'FACT_RESET_3' [footnote 1]
and reboots

4)	mmcblk0p1 passes control to mmcblk0p2 which sees 'FACT_RESET_3' in
mmcblk0p8 and loads mmcblk0p14 with cache:command set to wipedataui

*insertion point*

5)	init.rc sets mmcblk0p8 to 'FACT_RESET_6' to ensure no bootloops

6)	our custom recovery loads and ignores cache:command, thus entering
custom recovery.

7)	when recovery is finished, a simple reboot will return to normal operating mode

Footnote 1: http://forum.androidcentral.com/618482-post55.html
[LG Revolution] majorpay:
I'm here now and will get that dmesg. The darn forum didn't notify me that time you replied (I think they're having issues).
[LG Revolution] thecubed:
Excellent!

I think I may have solved the question of what p8 does...

it seems to be some sort of control block for the phone.

Not sure yet, but I think it may contain things like MEID and ESN also quite possibly.

Either way, it looks like it may play a role in our ability to get clockwork ported over.

And in more good news- I still see nothing that looks like any signatures on the fastboot images. I think either a) the phone is completely unlocked, or b) I'm not looking hard enough :)
[LG Revolution] majorpay:
some more various testing results:

When the device goes into charge mode (plug in, power on volume down), two devices show up:

LG USB Device: 0226

and unknown: 0a48:2021 (not sure what this is)

On recovery prompt, no usb device.

Plugged in, powered on volume up WITH USB CONNECTED (only way this can happen) "Download is in progress. Do not disconnect cable." The following devices show up:

usb same unknown device (not even sure this is the phone, I'll test this)

LG Electronics, LGE CDMA Modem

Edit: Unknown device is unrelated. Both adb and fastboot report nothing in both modes.
[LG Revolution] thecubed:
Okay dmesg wasn't super helpful, but it did show me that there's nothing super crazy weird going on here, besides LG's factory reset stuff (nothing in dmesg about that...).

I think it'd be safe to try a recovery image with adb enabled and a console (not starting android recovery). It appears that in the worst case scenario, we should be able to at least reboot into Android and just reflash the stock recovery image...

However, the only thing that worries me is the possibility to get stuck in recovery, and if recovery malfunctions (or ends up being signed) there would be no way to set the bootloader control block back to normal mode, thus bootlooping the device...

I'm going to head out again for a little while, and I'll take a look at it again later tonight (12PM-ish).

We'll either have a totally working CWM here soon, or the first bootlooping Revolution.

Either way: if anyone finds the stock firmware somewhere, that would be super helpful!