yashsingh1/xdaforums huggingface dataset:
[LG Optimus L9 P760, P765, P768, P769] shinobisoft:
This points to the IDA database that @shutt1e posted a few pages back. That takes care of the database, remember this is the unmodified bootloader.

As for the first or second stage... I'm not sure I can answer that correctly. The IDA database contains mmcblk0p2 ( uboot ) and mmcblk0p1 only seems to contain certificates. I know that from here if everything works as it should everything progresses to mmcblk0p3. So my guess would be stage 1. But I could be wrong. Here's a link to my x-loader, mmcblk0p1, in zip format tho it's only 384 KB uncompressed...

Hopefully this helps...

EDIT:

On another note, I have the patch [MENTION=5029238]shutt1e[/MENTION] made. I just haven't mustered the courage to flash it yet... LOL
[LG Optimus L9 P760, P765, P768, P769] BioDesigner48:
This could make a interesting thriller cx

The Story of the Evil BootLoader

sent from my rooted P769 v20f

I'm on YouTube (Toa Kaidoa)
[LG Optimus L9 P760, P765, P768, P769] LaDY Vengeance:
OK. I wasn't too sure that was the database. I'll send it to vitalif! This bootloader will fall!
[LG Optimus L9 P760, P765, P768, P769] shinobisoft:
There are two other mmcblk0??? partitions listed and I have no clue what they are for. From my dumps all I can tell is that they are both empty. The partitions are -> mmcblk0boot0 and mmcblk0boot1. They are both 2 MB ( 2,097,152 bytes ) in size.
[LG Optimus L9 P760, P765, P768, P769] LaDY Vengeance:
Ok. I just sent him the database and [MENTION=4501943]shinobisoft[/MENTION] x-loader. ;)
[LG Optimus L9 P760, P765, P768, P769] shutt1e:
i just managed to load into ida the x-loader at the correct address and filled some labels.

there are some interesting part of code regarding signature check. dunno if he can post here, but i'd like to share with him some thoughts.

here is the x-boot dissamble, Base Address: 40304350h - 40360A00h just a insane mind at Ti could choose an address like that.
[LG Optimus L9 P760, P765, P768, P769] shinobisoft:
Ok. So from what I'm seeing and have already observed, both mmcblk0p1 ( x-loader ) and mmcblk0p2 ( uboot ) have to be patched in order to unlock the bootloader for the P769. ?? [MENTION=5029238]shutt1e[/MENTION]
[LG Optimus L9 P760, P765, P768, P769] LaDY Vengeance:
Wow. I wonder if [MENTION=3622122]vitalif[/MENTION] will come here and toss some ideas around....this seems like such a project!
[LG Optimus L9 P760, P765, P768, P769] leolawliet:
Really quick question, is this sufficient enough to build Android with?

Toshiba - Satellite 15.6" Laptop - 6GB Memory - 500GB Hard Drive - Satin Black
[LG Optimus L9 P760, P765, P768, P769] shutt1e:
seem so. the patch on the uboot only seem to break the loading stage. it don't print anything on video because the xloader don't has any printing function. Before to patch the xloader i need to know one thing. the procedure reported by kuma82 at post #2000 could recover the phone even if the xloader is unable to start?

if so we can try some patches to the xloader whithout to have to worry so much.

For what i have seen the xloader do some basic initializations, check if that is a fota boot or a normal boot, then seek the partition containing the uboot, do some checks and jump to it. code flow never return to the xloader after the jump.

the code we have to mess with imho is around 0x40304974.
[LG Optimus L9 P760, P765, P768, P769] kuma82:
I have erased the x & u with that fastboot, so yes. Upload the modified x & u and I'll test it out ;) if it boots on mine it should work for all and all for one.

Just to make sure, I'll modify an x-loader and flash it. then I'll try to recover it with fastboot. The only thing about the x is it won't except any thing bigger than the original size. I'll post back in a few.

Update:

I am correct, flashing a mod x will not hard brick the phone.

Okay this is what I did

I modified the x-loader with a hex editor, and changed the following

Welcome to OMAP4 Bootloaer!

to

Welcome to OMAP5 Bootloaer?

and flashed it with the unofficial fastboot and tried to reboot.

The phone didn't boot, so maybe something is checking the x-loader as well.

I thought what I changed wouldn't make much of a difference but I'm not sure how important that line is.

ANYWAYS

I started up fastboot again and restored the metro x-loader and the phone booted fine :highfive:

Note: I didn't make any changes to the u-boot during this process.
[LG Optimus L9 P760, P765, P768, P769] shinobisoft:
I'm confident I can restore my device as well, so... I'll test too!

---------- Post added at 10:00 AM ---------- Previous post was at 09:56 AM ----------

Yes but... You'll be looking at long build times. I have an HP G60 with Intel dual core 2.1 Ghz and 4 Gb RAM. A CM11 build for my Galaxy Tab 2 took 7 hours to build. :eek:
[LG Optimus L9 P760, P765, P768, P769] LaDY Vengeance:
Vitalif said that patching u-boot will always lead to a brick. It's the primary bootloader that needs to be patched....and that it needs proper disassembly before patching.

Do you guys think that it could be the x-loader that needs to be patched?

---------- Post added at 10:58 AM ---------- Previous post was at 10:53 AM ----------

LOL...I should read before I post. I just read what shutt1e posted. :rolleyes:
[LG Optimus L9 P760, P765, P768, P769] leolawliet:
I'll take my chances, I just found out a friend of mine owns it too and it performs the way I expected it to.
[LG Optimus L9 P760, P765, P768, P769] shinobisoft:
I was just looking at your link again. No mention if it's 64 bit or 32 bit. 64 bit is REQUIRED to build cm9 ( Android 4.0 ) and newer. Apparently 32 bit will suffice for older versions of Android tho.
[LG Optimus L9 P760, P765, P768, P769] shutt1e:
surely your change didn't affected the functionality of the xloader.

there must be a crc check on the xloader itself also. i don't think the crc check come from the phone rom,wich is on charge to load the xloader. so, let try to defeat this check first.

indeed the first thing to do is to try to understand where the crc check is.
[LG Optimus L9 P760, P765, P768, P769] shinobisoft:
I really wish I could help. I've been reading up on LK ARM Assembley, but I just can't seem to wrap my head around it. I've been a C/C++ programmer way too long apparently :eek::silly::p
[LG Optimus L9 P760, P765, P768, P769] LaDY Vengeance:
I did ask vitalif about the crc check in x-loader. :)
[LG Optimus L9 P760, P765, P768, P769] carloswii5:
All new computers now run 64 bit...
[LG Optimus L9 P760, P765, P768, P769] leolawliet:
It should get the job done for 4.x.x firmwares, it's 64 bit with 6gb of RAM. At least the processor is comparable to i3.
[LG Optimus L9 P760, P765, P768, P769] shutt1e:
these are better disassembly of both x-loader and u-boot, so if Vitalif want to give a look at them they are here.
[LG Optimus L9 P760, P765, P768, P769] LaDY Vengeance:
Okay, [MENTION=5029238]shutt1e[/MENTION]....I'm going to send it to him. Thank you! Also, he sent me this message....

Oh, I've just noticed - the image you sent to me is from /dev/mmcblk0p1. It's not /dev/mmcblk0p1 that should be investigated, it's just /dev/mmcblk0.

The first-stage bootloader is usually located before the first partition (its size is usually less than 128-256 kb), and I'm pretty sure it's him checking the signature on x-loader (or whatever it is). The first 4 bytes in image should contain the size of stage1, the next 4 bytes should contain its loading address (it's how OMAP boots).

So someone should first dump the first, say, 256 kb of /dev/mmcblk0 and then try to look at it in IDA.
[LG Optimus L9 P760, P765, P768, P769] shinobisoft:
There is no /dev/mmcblk0. There is a/ dev/block/mmcblk0 and I did notice a size difference when totaling the sizes of all mmcblk0 partitions. I'll see if I can dump it in a little while. Gotta wake up first :eek:
[LG Optimus L9 P760, P765, P768, P769] shutt1e:
the first stage bootloader, also referred as x-loader, is on mmcblk0p1. mmcblk0 is the whole emmc disk. at the start of the emmc there should be the partition table (gpt)

on the unpacked v20h firmware there is the whole partition image, as you can see it contain the gpt partition table and then the x-loader.

here is the full partition image, but it don't has nothing more than that we have already.
[LG Optimus L9 P760, P765, P768, P769] shinobisoft:
So no need for me to dump part of mmcblk0 ?
[LG Optimus L9 P760, P765, P768, P769] Ilxaot:
The excitement.
[LG Optimus L9 P760, P765, P768, P769] shinobisoft:
[MENTION=5029238]shutt1e[/MENTION]

Maybe you can answer this. Using /proc/partitions I calculated the size of all mmcblk0p?? partitions. Totaled, they are 3456 blocks larger than the reported size of mmcblk0. mmcblk0 is supposed to be 3784704 blocks ( block == 1024 bytes ). All mmcblk0p?? total to 3788160 blocks. Any ideas???
[LG Optimus L9 P760, P765, P768, P769] LaDY Vengeance:
I just sent it to vitalif, [MENTION=5029238]shutt1e[/MENTION]. We really are making a big push here. I hope all this hard work will pay off! :)
[LG Optimus L9 P760, P765, P768, P769] shutt1e:
humm, really don't know, but blocks should be 512 bytes not 1024
[LG Optimus L9 P760, P765, P768, P769] shinobisoft:
Hmm... mmcblk0p1 is 384 blocks. My dump of mmcblk0p1 is 384 KB or 393,216 bytes. Makes a block equal to 1024 bytes. Not saying you're wrong, but that's what the math is telling me.
[LG Optimus L9 P760, P765, P768, P769] Ilxaot:
I don't even know why I'm still on this thread, this is so above my head. You guys can do it!(:
[LG Optimus L9 P760, P765, P768, P769] shinobisoft:
Scanned the whole dump. I saw a bunch more interesting stuff further down in the dump. I just dunno what to do with it. :p:silly:

I found a couple sections that seem to have something to do with different types of certificates, starting at 0x20200.

The word 'kmain' at 0x29480 with some other stuff immediately after it.

More certificate type stuff at 0x80000 and 0x80238.

That's just what I took notes on. There's tons more. Though it's still possible that everything I've found has nothing to do with what we're trying to accomplish. Fingers crossed though :D
[LG Optimus L9 P760, P765, P768, P769] Ntrasme:
I have a question, why is it that some people have unlocked the bootloader? No one seems to give a clear answer how they did it. Is it luck? Is it based on the phone?

If it's based on the phone then nothing we can do can change it right? If it's not based on the phone then how have some people succeed? Sorry if it's a lot of questions, but all of this information is overwhelming. I see promise in this project yet however. Can't wait to get CM11 on our L9 :p Good Luck!
[LG Optimus L9 P760, P765, P768, P769] ISITBRICKED:
Its not easy took me several tries. Its a lengthy in depth process and some phones just don't unlock such as lady cuz she has tried so many times no way she is doing it wrong every time. I really hope shuttle can help you guys

Sent from my unlocked LG P769 running unofficial CM11
[LG Optimus L9 P760, P765, P768, P769] omgbossis21:
a newly written x and u would do the trick but a lot of work.... From what I have seen their is a bootloader flag stored as a nvalue (you can read about them on omap devices). Anywhere in the dump did you notice a nv(x)? I believe its nvalue 16 so it would be nv(16) . The x or the u (or possibly a quick check before the x evne loads) checks this nvalue to present a locked or unlocked bootloader. Its similar to how the nvalue works with the voltage control of the processor. You can see it and its function in the code for it.
[LG Optimus L9 P760, P765, P768, P769] Ntrasme:
I've been reading more and it seems Metro ones are easier to unlock? (I'm not sure about that) My phone used to be Metro but after I flashed a T-Mobile KDZ it's no longer Metro.(Did i screw myself over?) I still have the Metro SIM in it, however. On the "Dominate your L9" thread they were talking about having the LG logo in the center, which I have. The steps in unlocking the bootloader are also cryptic. Some say flash Radio.zip, others say turn on wifi, there are so many buried comments, it's hard to tell what to do. On a side note: Lucky you and your CM11....I'm so jealous.
[LG Optimus L9 P760, P765, P768, P769] ISITBRICKED:
I came from wind mobile canada. Flashing radio didn't help me I had to physically swap radio files during the kdz flashing then I was able to unlock. I think it took me 3 tries. I think without kuma I would still be locked.

Sent from my unlocked LG P769 running unofficial CM11
[LG Optimus L9 P760, P765, P768, P769] leolawliet:
I wonder.. would a dump from an already unlocked bootloader kinda help in some way?

Maybe checking for comparisons or something could lead to something.
[LG Optimus L9 P760, P765, P768, P769] shinobisoft:
It very well may. Please do in fact.

Issue the following in terminal emulator or as ADB shell commands:

su
dd if=/dev/block/mmcblk0 of=/storage/external_SD/unlocked_mmcblk0.bin bs=512 count=2048

This will actually copy the x-loader and u-boot plus what I believe to be the PIT table.

---------- Post added at 01:56 AM ---------- Previous post was at 01:48 AM ----------

On another note::

What I've figured. With the dump I attached earlier ( out.bin ), I've determined the following...

1) x-loader starts at offset 0x20000

2) u-boot starts at offset 0x80000

Using IDA to search and list all of the strings within out.bin was extremely useful.

I also think the funky offset @shutt1e was having to use was because of a different approach when creating the dumps. To make a long story short, I believe my original attempt introduced some unwanted padding.
[LG Optimus L9 P760, P765, P768, P769] shinobisoft:
Ok. For some reason something made me dump mmcblk0p7 which is labeled 'nv'.

This is what I found...

Orange is the offset where the data starts

Blue is the actual data found if it wasn't private data

@ [B][COLOR=DarkOrange]0x1000[/COLOR][/B] - [COLOR=Blue]15 digit hex number[/COLOR] - My IMEI number
@ [COLOR=DarkOrange][B]0x1A00[/B][/COLOR] - [COLOR=Blue]LGP769AT-01-V20h-310-260-AUG-14-2013+00[/COLOR] - Software version
@ [COLOR=DarkOrange][B]0x1C00[/B][/COLOR] - [COLOR=Blue]Series of 31 0x01's and 0x02's[/COLOR] - No idea
@ [COLOR=DarkOrange][B]0x1E00[/B][/COLOR] - [COLOR=Blue]12 digit hex number[/COLOR] - Withheld cause I dunno if it's important :p
@ [COLOR=DarkOrange][B]0x3C00[/B][/COLOR] - [COLOR=Blue]L6260_MODEM_SIC_01.1305.00\n[/COLOR] - Baseband version
@ [COLOR=DarkOrange][B]0x6403[/B][/COLOR] - [COLOR=Blue]0x69[/COLOR] - All by it's lonesome ???
[LG Optimus L9 P760, P765, P768, P769] leolawliet:
We got a problem, my storage reads as an sdcard instead of external sd so this happened lol
[LG Optimus L9 P760, P765, P768, P769] shinobisoft:
Ok. With a file explorer and browse /storage. /storage/sdcard0 should be your internal sdcard, is there a /storage/sdcard1 ? If so just replace /storage/external_SD with the found path to your external sdcard.

It can be put on your internal sdcard too, it's only 1 MB
[LG Optimus L9 P760, P765, P768, P769] leolawliet:
Internal sd is disabled in this ROM. It reads as /storage/sdcard0

So this should do the trick

su
dd if=/dev/block/mmcblk0 of=/storage/sdcard0/unlocked_mmcblk0.bin bs=512 count=2048
[LG Optimus L9 P760, P765, P768, P769] leolawliet:
Got it :)

https://app.box.com/s/0f8azshthkyc0bmeikky

unlocked_mmcblk0.bin

Also it's from P760 x-loader u-boot & PID, not P769 ones. It's what I had to install to run custom ROMs.

Compare if you can :)
[LG Optimus L9 P760, P765, P768, P769] LaDY Vengeance:
I just sent this to vitalif! :)
[LG Optimus L9 P760, P765, P768, P769] vitalif:
What I'm seeing here is a very strange thing: there's really just a gpt partition table O_O that table with patterns described some posts ago was GPT :)

I'm sure OMAP boot ROM can't boot directly from GPT, there's nothing like that in the datasheet :) so there should be some other boot code and we don't know where is it... :-/

Maybe there's some additional memory chip? Are there some /dev/mtd* device?

Also, can you use devmem2 tool and try to dump booting configuration using 'devmem2 0x480022f0 b' command? At least we'll know from where it boots...
[LG Optimus L9 P760, P765, P768, P769] ttld1oh1:
Welcome aboard. Thanks for joining :)

No /dev/mtd found anyway.
[LG Optimus L9 P760, P765, P768, P769] shinobisoft:
I'm assuming that 'devmem2' is on a Linux box ( no problem ), cause it's not on my device, just devmem.

EDIT: Found it for Ubuntu 13.10. Installing to my build PC
[LG Optimus L9 P760, P765, P768, P769] omgbossis21:
I've been through and through with the nv partition on the l9. I even hex edited my nv partition to match a unlocked one with no luck (most info in a thread I created under development called code guru needed). TI Omap boards don't use a efuse per say, they represent one with a nvalue which is likely stored in the secure memory area. The voltage control I was thinking of is smartreflex which can be altered using a nvalue and is visible in the source for this phone.
[LG Optimus L9 P760, P765, P768, P769] shinobisoft:
I can't for the life of me get to or find devmem2 although package manager says it's installed. I'm no Linux guru although I am learning. Software updater keeps telling me that it cannot download repository information and to check my internet connection but I have no problems getting online with Firefox. At a loss...
[LG Optimus L9 P760, P765, P768, P769] kuma82:
This information and tool may give us the information we are looking for

http://xdaforums.com/showpost.php?p=45573702&postcount=190

How to run it

http://xdaforums.com/showpost.php?p=45576740&postcount=192
[LG Optimus L9 P760, P765, P768, P769] shinobisoft:
Ok. Still having issues with devmem2, however I did make a successful dump with the omapconf tool @kuma82 just posted a link for.

Maybe, just maybe what we're looking for is contained in the attached archive.
[LG Optimus L9 P760, P765, P768, P769] omgbossis21:
You can find that dump in the code guru thread =-)
[LG Optimus L9 P760, P765, P768, P769] LaDY Vengeance:
Vitalif is here. YAY! :D
[LG Optimus L9 P760, P765, P768, P769] kuma82:
There is a lot more useful information of stuff we tried and looked at in that thread (the link I gave you to lelus post)
[LG Optimus L9 P760, P765, P768, P769] omgbossis21:
http://xdaforums.com/showthread.php?t=2374554
[LG Optimus L9 P760, P765, P768, P769] shutt1e:
up to 0x00080000 both dumps looks like the same,same partition names, same gpt header. so this mean the the x-loader (starting from 00023950) is absolutely the same.

differences are only on the u-boot

(HxD hexeditor)
[LG Optimus L9 P760, P765, P768, P769] leolawliet:
So x-loader is fine as is, and what we're looking for might just be in the u-boot?
[LG Optimus L9 P760, P765, P768, P769] LaDY Vengeance:
I found this information while googling......

http://blog.csdn.net/yasin_lee/article/details/7229349

On that page it states that " The nand x-loader expects u-boot to be loaded at the 5th sector (offset 0x00800000). It transfers the image from nand into main memory and transfers control to it."

---------- Post added at 10:23 PM ---------- Previous post was at 10:22 PM ----------

It may or may not apply to our phone....just wanted to share! :)
[LG Optimus L9 P760, P765, P768, P769] kuma82:
How about complying it devmem2

https://gitorious.org/android-n900/...3ee19bfbaccb370d590f7:tools/devmem2/devmem2.c

https://dev.openwrt.org/browser/packages/utils/devmem2/src/devmem2.c
[LG Optimus L9 P760, P765, P768, P769] andras7008:
what is vitalif :) ? Sorry for noob question :)
[LG Optimus L9 P760, P765, P768, P769] aod990:
This is vitalif
[LG Optimus L9 P760, P765, P768, P769] LaDY Vengeance:
fatload mmc 0:1 0x81000000....this keeps showing up when I search OMAP u-boot. It shows up for the Nook and Beagleboard. Is this some kind of command?
[LG Optimus L9 P760, P765, P768, P769] omgbossis21:
Perhaps loading a fat32 sdcard. I haven't been around since I got my optimus g although my girl still has a locked l9. I never got a l9 that could be unlocked to do anything with. I hope you all figure it out -=)
[LG Optimus L9 P760, P765, P768, P769] shinobisoft:
From what I've been reading OMAP can boot from MMC, eMMC, SD, and Serial ( as in serial port ).

Sorry guys. Outta free time during the week for the next couple weeks. I'll do what I can when I can in the evening hours until I've finished the job I started today.
[LG Optimus L9 P760, P765, P768, P769] rlopezcomputers:
Hello! Just my two cents here. I have a nook hd. The way they install android on it was by partition the sd card three way. One will be boot and it will contain the MILO,U-boot, Rom ,gapps. The second partition was for the system, and the third for data. Then we will go into recovery and install android on the sd card. Of course if you had 16gig Nook then u will do a install on the emmc and ur nook will be 100percent android. I am not sure what is exactly MILO or U-boot since I'm just your average user. But one of the developers is the famous adamoutler. Maybe he will have a better explanation
[LG Optimus L9 P760, P765, P768, P769] tokenpoke:
Anyone else find it ironic that the thread "unlock bootloader for noobs" has broken down into a very technical conversation about unlocking the bootloader?
[LG Optimus L9 P760, P765, P768, P769] leolawliet:
Lol now that you mentioned it I noticed
[LG Optimus L9 P760, P765, P768, P769] shutt1e:
well, i'm running out of ideas. seem the whole booting process is a chain of trust initiated by the hardware, so hardware check the x-loader, x-loader check the u-boot with hardware assistance, u-boot checks the boot.img with hardware assistance (i don't remember where i found this, but it was on the nook tablet bootloader thread) if you modify any of these files the chain of trust is broken and the device does not boot.

I was glad to help if this was just a find/debug/hexedit thing on the bootloader, as i made with my E730, but here there is much more. some on the nook tablet (which use the same processor as the L9) used a modchip to bypass the security, looks like this is the only solution.

On this post http://xdaforums.com/showpost.php?p=21221204&postcount=339 a guy developed a 2nd bootloader to be booted off the sdcard, i didn't understood so much of the whole procedure, and don't know if it apply to the L9, but if someone is skilled on compiling it worth a try.
[LG Optimus L9 P760, P765, P768, P769] LaDY Vengeance:
It's ok. Thanks for your effort! Yeah, it looks like TI uses a high level of security. I was reading about this last night....LG signs the images and is very hard to crack. :(
[LG Optimus L9 P760, P765, P768, P769] kuma82:
Thanks for you effort and time. Hardware checking x and etc. that is the same conclusion I have come to as well.

The only thing I can think of that can solve this bootloader puzzle is the usbboot.exe, p940-aboot.2nd & p940-u-boot_fastboot.bin. The usbboot.exe (appears to) connect directly to the TI Board and loads the p940 aboot & u-boot. I dove through the usbboot.exe with a hex editor but I'm not that skilled to fully grasp it.

I believe the p940 aboot & u are signed with the old gingerbread key that was leaked by LG. If I'm not mistake I modifed the p940-u-boot_fastboot.bin (slightly) and it wouldn't load the unofficial fastboot. (I'll check again to make sure)

I was wrong, I made a slight change and p940 u-boot still loaded.

We had someone try to sign a custom recovery image with the old key but it still threw a "LG Security Error". Maybe they just didn't sign it properly, or the key will only work on a correctly modified u-boot.

I'm hunt down the old key, hopefully if we sign your modified u-boot it might work if we use it instead of the p940 u-boot.

More info:

This thread http://xdaforums.com/showthread.php?t=1701471

seems to explain the whole process on how the usbboot.exe communicates with the OMAP (TI Board).
[LG Optimus L9 P760, P765, P768, P769] LaDY Vengeance:
I found these fastboot commands to force fastboot on reboot.

fastboot oem fb_mode_set

forces fastboot mode on reboot

fastboot oem fb_mode_clear

clears the forced fastboot mode

Can be helpful if you are playing around with trying to use fastboot reboot-bootloader / fastboot boot

Has anyone tried it? IDK....I wonder if I can sell this stupid phone on eBay.