yashsingh1/xdaforums huggingface dataset:
[LG Revolution] majorpay:
Well, in the meantime, working on sniffing the USB port of this device to find out what that "download" message is looking for. I'd guess it would be the way out if this all goes terribly wrong :) (assuming we don't overwrite it in the process.)
[LG Revolution] majorpay:
!!

I got a response from the person who bricked. They tried to build from p14 and it appeared to boot fine. It was only after a factory reset that everything went nuts. Rebooted into crap display and wouldn't boot.

That's as much detail as I have, but good to know.
[LG Revolution] thecubed:
hmm, well, where can i contact this person?

did all hell break loose after booting into cwm then doing a factory reset? that seems to be a big no-no on the Optimus series. factory reset = brickage on the optimus series from what ive heard.

-Posted on the go from my N900
[LG Revolution] majorpay:
You've got a PM
[LG Revolution] Jasbo:
maybe this had already been said but I noticed on power down that the front touch buttons are still lit up and the last thing to turn off after the screen. I wonder if LG added something where pressing one of these pushes something into memory for reboot?

I dont know anything about what you guys do but im having fun reading about it :) Thought i'd just chip in.
[LG Revolution] majorpay:
Not that this has anything to do with the price of tea in China (but keeping with my probing ADD):

I don't know if anyone caught this out of the dmesg:

<6>[ 0.000000] allocating 7340032 bytes at c130b000 (150b000 physical) for fb
<6>[ 0.000000] allocating 2097152 bytes at c1a0b000 (1c0b000 physical) for audio pmem arena
<6>[ 0.000000] allocating 2097152 bytes at c1c0b000 (1e0b000 physical) for KGSL
<6>[ 0.000000] allocating 6291456 bytes at c1f00000 (2100000 physical) for kernel ebi1 pmem arena
<6>[ 0.000000] allocating 24117248 bytes at c2500000 (2700000 physical) for sf pmem arena
<6>[ 0.000000] allocating 26214400 bytes at c7900000 (7b00000 physical) for adsp pmem arena
<4>[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 112388
<5>[ 0.000000] Kernel command line: console=ttyMSM1 androidboot.hardware=qcom uart.mode=uart_disable lge.rev=rev_f lge.hreset=off lge.reboot=reboot androidboot.emmc=true
<6>[ 0.000000] PID hash table entries: 2048 (order: 1, 8192 bytes)
<6>[ 0.000000] Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
<6>[ 0.000000] Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
<6>[ 0.000000] Memory: 60MB 133MB 256MB = 449MB total
<5>[ 0.000000] Memory: 373376KB available (7048K code, 4788K data, 184K init, 0K highmem)

There's your explanation as to why is says 384 megs of RAM when it was advertised as more.
[LG Revolution] stetsonaw:
Good find dude!

Sent from 1885
[LG Revolution] bwhxeon:
I'm lost, it looks like the ram is there, but I'm assuming since it reports like that, that its allocated to parts of the chip?
[LG Revolution] thecubed:
So, me and birdman had a chat about this phone yesterday.

He pretty much got as far as I have-- he created a custom recovery, pushed it to p14 properly, then said "factory reset" by holding the volume button and power...

Unfortunately it pretty much instabricked. The problem here is that from what he said the phone didn't even try to boot the modified recovery, it just sat there at the LG boot logo.

To make matters more complicated, once you tell the device to do a factory reset, it won't boot android until it's sure it's been reset, so without a way to put p8 back to "FACT_RESET_6" from "FACT_RESET_3", the phone will keep trying to boot into recovery.

I've been looking around for the source of LG's custom recovery application, and I can't seem to find it... then I noticed something...

Add up all the partitions listed for mmcblk0pX, and compare them to the total size of mmcblk0.. it's about 200mb less! I think AMSS is hiding itself from Android, and I have a feeling that's where the weird LG factory reset stuff resides.

Either way, we need to find a firmware update file somewhere for this phone so if we brick it, we can return it back to working condition-- since I have a feeling that this may not be a walk in the park until we figure out what the LG factory reset stuff is.
[LG Revolution] thecubed:
Yeah, the RAM is allocated to other functions on the device (like the GPU and whatnot)
[LG Revolution] majorpay:
That sucks. I have spent a good portion of the day searching around for the stock firmware and have found nothing. Interestingly, I have found a few sparse sites such as this one: http://www.electronista.com/articles/11/03/16/netflix.for.android.shows.in.lg.revolution.code/ that claimed there was a leaked firmware somewhere. Keyword "claimed." Whether this was just someone who happened to get their hands on the device and happened to pull off the .apk vs. someone who actually got their hands on the firmware, it sounds like the former is more likely than the latter. I will continue to do my searches, but I have not turned up anything. I even tried to get dirty on my searches by searching for files outside the US (i.e. China, Netherlands). I found one site that was hosting firmware of all the different phones and had an entire repository of firmwares, but it looks like they lost interest or were cut off around early 2010.

Even if we find the supposed "leaked firmware," we are putting our faith in an unknown as a reliable source.
[LG Revolution] thecubed:
A "leaked firmware" would be good too, if not to just see what it contains.

I'm wondering if like Jasbo said earlier that it may be possible that the bootloader checks the capacitive buttons on boot.

Can you try holding Home+Power and etc?

I'm just trying to figure out how LG gets into recovery to install an update.zip since recovery is the only way to do it... it may be possible that therein lies some clues...

Anyone up for decompiling whatever it is that does the OTA firmware update checks in Android?
[LG Revolution] majorpay:
If I had a loaner to give to Koush, I would, so that he could play with it at the same time as we were working on this - assuming he had time (more eyes, more chances to find something), but unfortunately, I only have ONE phone (no landline, etc), so that is a definite no-go for me.
[LG Revolution] thecubed:
That would speed things up, but I think he'd run into the same problem birdman did of bricking it by pushing custom recovery....

I'm almost wondering if it's signed...
[LG Revolution] majorpay:
The capacitive buttons look dead to me, but I'll go through the process of looking into it. OK, so here's a thought (and it's out there, I know). What if their custom loader (prior to recovery) checks for the presence of update.zip, and if missing, doesn't allow recovery visibility? Like you said, there has to be a way to update the phone from flash (you would think).

The other option is that they have removed the functionality entirely because they wanted the LG Mobile Support Tool (http://www.lg.com/uk/support/mc-support/mobile-phone-support.jsp) to be the only method for update. I GUARANTEE YOU (99.9% certainty) this tool can push and flash.

What is it that you want decompiled? Have you identified the segment at this point?
[LG Revolution] thecubed:
I'm wondering if we can find the URL the phone checks for OTA updates.

IF we can find that URL it is possible that we can spoof it into giving us a factory-condition update file to feed to LG Mobile Support Tool.

Secondly, what happens when you run LG Mobile Support Tool? Does it give you any options to factory reset or update?
[LG Revolution] majorpay:
I haven't even run it yet. This just came up in my search for the firmware for this device.

I might be able to run a trace of network traffic to view what traffic is coming in and out. That should be able to identify if we are getting anything in or out and the points it comes from. It would surprise me if they didn't encrypt their traffic and require some sort of challenge/response to grab their updates. I'm (almost) positive it would be an SOA service that handled the negotiation.

Saying all that, Sony left PSN wide open, so who knows?
[LG Revolution] thecubed:
Had an idea, sent you a PM.
[LG Revolution] majorpay:
You've got one now too.
[LG Revolution] thecubed:
EPIC WIN!

LG Mobile Support Tool DOES download original firmware!

It just requires a MEID!

Now to sniff/dump the firmware it downloads :) yaaaayy
[LG Revolution] majorpay:
L-O-L... I can't believe it was that easy.

Edit: You know, they included BusyBox installed on this device, so something tells me they weren't necessarily *against* devs mucking with it. Perhaps they just want to control it a bit to protect their assets (after all, people go changing things, brick, and it gets sent back to the company = lost profits).
[LG Revolution] thecubed:
Okay, well good news!

I found the URL's for the update, but without having an actual phone connected, it won't download the software... here's what I've got so far though...

Upon entering your IMEI in the "recovery phone" menu in LG Mobile Support, it checks this url:

http://csmg.lgmobile.com:9002/svc/popup/model_check.jsp?model=&esn=<YOUR ESN>

and receives this back:

<response req_cmd='check_model' status='ok'>
<auth>
<model>LGVS910</model>
<suffix>AVRZBK</suffix>
<esn>YOUR ESN NUMBER</esn>
<msn>YOUR MSN NUMBER</msn>
<esndate>20110XXYY (redacted)</esndate>
<buyer>VRZ</buyer>

<esnoutgodate>SOME DATE</esnoutgodate>
<ULocationcode>N</ULocationcode>
<buyername>Verizon Wireless</buyername>
<csn>POSSIBLY SENSITIVE</csn>
</auth> </response>

(sensitive information redacted)

After that, the updater checks a few urls for things like strings and whatnot, but then it asks:

http://csmg.lgmobile.com:9002/csmg/b2c/client/auth_model_check2.jsp?esn=<YOUR ESN>

and gets:

<response req_cmd='auth_model_check' status='OK'>
<auth_model_check>
<result>2</result>
<esn>YOUR ESN NUMBER</esn>
<model>LGVS910</model>
<suffix>AVRZBK</suffix>
<msn>YOUR MSN NUMBER</msn>
<esn_date>2011XXYY (redacted)</esn_date>
<sw_version></sw_version>
<sw_url></sw_url>
<sw_locale_url></sw_locale_url>
<sw_recommand_uri>GLOBAL/GLOBAL</sw_recommand_uri>
<app_version></app_version>
<app_url></app_url>
<cs_em_flag>N</cs_em_flag>
<cs_em_uri>N</cs_em_uri>
<chip_type></chip_type>
<prod_type></prod_type>
</auth_model_check> </response>

"sw_url" looks like where it would go to download the software, but since I don't have the phone, it starts to do something then says "waiting for phone" before it gets to the "downloading software" stage.

Anyone want to try the "Recovery Phone" option in LG Mobile Support Tool with their phone plugged in and wireshark running all the way up to the "Downloading..." progress item in the 2nd window that pops up? There is a possibility that it will wipe your device, though.
[LG Revolution] majorpay:
As expected, you've got an SOA model.

If no one volunteers, I can get this done when I get home tonight. It may contain some sensitive information, however (I'll look at that after it's done).

What is it that you are trying to get out of this? Are you just trying to grab the stock firmware from their server?
[LG Revolution] thecubed:
Also, could anyone post their software version? Something like V10A_00 or whatnot... hopefully...

URL for firmware (once we know what version we have):

http://csmg.lgmobile.com:9002/swdata/WEBSW/LGVS910/AVRZBK/V10a_00/V10A_00.kdz

the last two URL parts need to be changed accordingly, but I figure once we know what version of s/w we're running-- this URL will magically become our best friend :)
[LG Revolution] thecubed:
I'm trying to get the stock firmware so that in case we try messing around with recovery, we can always unbrick the device.

I don't want to play around with pushing anything to flash until we have a way to get back to stock...
[LG Revolution] majorpay:
VS910ZV4

./10chars
[LG Revolution] leemsami:
i will volunteer!!!
[LG Revolution] majorpay:
You've got another PM whenever you have time.
[LG Revolution] majorpay:
If you can run the sniffer while doing the recovery (assuming the tool actually lets you recover) using the LG tool, and post the results here, that's what we'd be looking for.
[LG Revolution] clabr20:
Just walk me through want you need me to do.
[LG Revolution] Haxcid:
Good Luck. We are all hoping something comes out of this. I did look through the tool, but it does not list the VS910 as a supported device for recovery. (probably just has not been updated).
[LG Revolution] thecubed:
If anyone wants to set up a wireshark dump while running the tool, and upload the wireshark dump somewhere, I could take a look and see where the firmware is being downloaded from.

However, from what I've seen, the firmware URL should be in the second response that I posted as the "fw_url". What I'm thinking is that LG just hasn't posted the stock firmware just yet... anyone have an IMEI for another recent android LG device so I can compare what URLs are returned?

We may just have to hurry up and wait for LG to post a stock ROM somewhere before work can continue...
[LG Revolution] majorpay:
Fail

I tried the tool, and no luck. I don't believe this tool is configured to work with this device:

First of all, as we all know, the device is not listed in it's list of supported devices.

Next, and most importantly, while it recognizes what type of device it is based on the ESN, once it goes into the update process (using the recovery tool), it starts analysis, asks to pull your battery and usb cable and restart a few seconds after starting up (and pressing "reset" - a button not on our phone). After that, it has a button for restart, you try it multiple times, but nothing happens, it just comes back saying you can try restarting because it's having trouble communicating with the phone.

It detects my drivers are in place, the whole nine yards, but it just won't communicate (I don't think it knows how).

Lastly, after multiple tries, the program states it has failed and prompts you to exit.
[LG Revolution] majorpay:
To put the nail in the coffin, a service runs in the task bar by default. This service is supposed to read your phone, but the "read phone info button" will not read your phone into the phone list like it's supposed to. Multiple attempts in multiple modes has failed.

It seems to me LG has not made good on the support for this device as of yet. This is disheartening.

Edit: hold onto that thought a second... It looks like this phone has it's own software.

Edit: It's the same freaking software listed for this phone. http://www.lg.com/us/support/produc...=documents&targetPage=support-product-profile

Still fails to communicate.
[LG Revolution] majorpay:
Just got off the phone with LG. At first they said the tool doesn't support the phone based on the supported device list, then they said it does, but there aren't any updates (because I pointed out it was on their website for this phone), then they told me sometimes the tool works sometimes it doesn't.

Their final answer was it's a new phone, there are no updates, and even if there were, Verizon takes care of updates.
[LG Revolution] thecubed:
Have you tried putting the phone into download mode like what you were in earlier with the volume and power button?
[LG Revolution] majorpay:
yes, and that didn't work either...
[LG Revolution] majorpay:
Since those tests, I have been trying every backdoor key combo I can find and none of them work - I tried confirming the factory reset and hitting power-up, power-down, not confirming with power-up, power-down, both buttons (middle press), powered on with all those key combos, went into the software download mode, none of them worked, battery mode, none of them work.

I swear there is no key combo to get into recovery (how messed up is that?)
[LG Revolution] thecubed:
Here's one more thing to try: put an empty file called update.zip on your SD card...

try booting normally, then with the button combos...
[LG Revolution] majorpay:
I was one step ahead of you on that one. None of the combos with that either.

It's a little sad the way they locked down this phone. It's a great phone. I'm going to keep it, but I'll be tempted to deodex it and fix Google (and possibly brick it).
[LG Revolution] thecubed:
Bummer. Well, looks like we're gonna have to hurry up and wait.

I just don't know what to try next until we have a working restore procedure.

Somehow, I'm thinking the only thing that will yield fruit is to decompile the software that performs the hard reset on the android side of things.. it may be possible that we can set some sort of flag to allow us to boot into recovery safely from within android...

Not sure entirely of the details, but it's in my head somewhere...
[LG Revolution] majorpay:
What language are we looking at decompiling? Any idea? Do you know the specific file yet?
[LG Revolution] thecubed:
Most likely a .jar file, so baksmali should take care of it.

As for which file, I looked in the Settings.jar->MasterClear.java (in the CodeAurora Forum Git page) , and it seems to look for some sort of service to start the hard reset. From there, I'm sort of at a loss.

I was going to decompile using the /system dump provided on XDA here, but the download is corrupt...
[LG Revolution] majorpay:
Yeah, I noticed that too. You want me to push you a /system dump in zip format?

Edit: That doesn't work - symlinks get broken. (assuming I remember correctly)
[LG Revolution] thecubed:
Yes please! I don't care about permissions or filesystem stuff, so just an archive of the files would be great.

The things I'm looking for are as follows:

1) How the heck does LG push a firmware update?

1a) How, once downloaded, does recovery get invoked?

1b) Once recovery is invoked, what then?

2) What happens in Android when a factory reset is invoked from within Android?

2a) Once the reset is invoked, what does p8 contain?

2b) Is it possible that the radio interface library has any information about p8 that we should be aware of? (i.e. write X to location Y to allow recovery prompt...)

Anyway, I sure hope this doesn't turn into the long and impossible project haha
[LG Revolution] majorpay:
You still have my ftp? I went ahead and threw it on there. I didn't compress it and transferred it directly from Android (and tested an extract). It's probably got a lot more than you need, but this should cover you. 629Mb. I have 5Mb upstream, so hopefully it won't take you all night :D

Let me know if you need the credentials/server loc again or not.
[LG Revolution] thecubed:
Downloading now... should take about 20 mins, I'm getting about 500KB/s.

Thanks!

EDIT: got it, going over the files now...
[LG Revolution] thecubed:
Someone who's done the master reset, can you try ADB pulling /cache/recovery/*

Those files might have something interesting in them...

Right now I'm decompiling LGHiddenMenu.odex, services.odex, framework.odex, and lgsvcitems.odex.

LGHiddenMenu has some interesting strings regarding bootloader and firmware updating. edit: appears it's referring to the touch panel's firmware and merely just checking the CRC of the bootloader... but it does tell us that mmcblk0p3 is important in some way...

Services.odex has references to the master clear sequence, as well as various mmc partitions.

LGSvcitems.odex has some other interesting tidbits also...

More to come as soon as I actually understand what's going on here :)
[LG Revolution] clabr20:
ok what all do you want me to pull
[LG Revolution] thecubed:
Nothing right now, it seems that we've got pretty much all of the dumps from the phone. We're kind of stuck without a factory recovery method, since we don't want to risk bricking.

Here's a random question, has anyone with adb access tried "adb reboot bootloader" ? Not entirely sure what it would do, but on some devices, it puts them into fastboot mode.
[LG Revolution] clabr20:
just reboots the phone
[LG Revolution] thecubed:
Er, sorry, should have been "adb reboot-bootloader"
[LG Revolution] clabr20:
same thing just takes it a second to reboot
[LG Revolution] thecubed:
anything with "adb reboot recovery" ? (yeah, reboot-bootloader and reboot bootloader are the same I just discovered...)

Thanks!
[LG Revolution] clabr20:
when i "adb reboot recovery mode" it gives me the lg symbol 3 times and then reboots
[LG Revolution] thecubed:
Hm. Okay. Well seems to me like LG is doing something very weird with recovery.

I'll take a look at this again tomorrow in the morning...

Thanks for giving it a go :)
[LG Revolution] majorpay:
Maybe "adb reboot recovery" with the standard key combinations (power up, down, both). Saying that, I think LG has completely locked out recovery with their custom loader. My guess would be that any reboot just bypasses it in favor of theirs. It's is a weed that needs removal.

I'd also venture to guess that any work they had done in the lab was done through a proprietary interface, and I'm starting to believe a lot of the attempt to keep us out was to prevent us from modding the device in favor of ensuring the security of their DRM agreements with the MPAA (bi-proxy Netflix), hence their new approach. I'm somewhat OK with that, sans "bingifying" the phone.

Now for my conclusion to my little rant in speculation with yet another rant: Why is it that Microsoft is allowed to mess with an Android phone when it's in their best interest to see Android fail? Given their release of Windows Phone 7, I'd say there's a serious conflict of interest issue here.

OK, back to the matters at hand :D
[LG Revolution] majorpay:
I gave you full access to FTP and added a password (same as user minus "dev").

If you get a chance prior to late tonight, could you forward the decompiled code. I'd like to do some digging. If you don't get a chance, that's fine, I can take care of it either later on tonight or tomorrow.
[LG Revolution] majorpay:
Here's another, totally off the wall thought:

What if we could identify the partition/code that created the "downloading please do not disconnect the cable" interface and replace it with a custom recovery? I'm just shooting from the hip here, but if this section is outside of the normal boot process, we should be able to mess with it all we want with no consequence to the rest of the phone, right?

(this is all talking out my butt, because I don't know where it is, how large it is, and if it REALLY is outside the boot process, but while we're grasping at straws...)

Edit: Here's what leads me to believe this is residing outside of Android: This can be booted into without ever even seeing the LG logo or any sign of a boot process. The problem is getting into it can be tricky. The right timing with plugging the USB cable with the power and volume up deal seems to be crucial - and awkward.
[LG Revolution] clabr20:
you can get into that menu without having the battery in just by having the device in holding power and volume up. so its a possibility
[LG Revolution] thecubed:
Quite honestly, I just need the AMSS firmware, which would come from a full system restore image from LG.

I'll run the AMSS firmware through IDA and disassemble it to see what's going on... but right now we can't dump the partitions from within a booted Android environment.

Apparently p3 is supposed to contain something, since I see references to it in the bootloader, but the dump you gave me just contains 0xFF so I figure it's being blocked by the radio.

Partitions 10 and 11 are still a mystery. No idea what they are, but they're compressed, that's for sure.

I have a feeling that once we understand what happens when you run the LG factory reset, we can hook into that to our advantage. But right now we're stuck since we have only one try per device :)
[LG Revolution] majorpay:
Right, so brick everyone in the community, they can't reject us all for returns, right? :D

It is sounding more and more like this will have to go on hold until someone can produce either a leaked version or a production version. Without being a able to backup a live device we're kind of screwed.
[LG Revolution] majorpay:
Did you happen to check that system file (I know it looked corrupted) to see if it was misnamed from img to zip?