[LG G Pro 2] pcfree:
For those who own G Pro 2 D838 that cannot enter stock recovery to run adb sideload option (ioroot25), this tutorial teaches you how to grant root access through normal adb (ioroot24).

After long time investigating LG TOT file structure, I've found the way to partially flash a partition. And if you flash, for example, F350K kernel into a D838, you can run modified ioroot24 batch file by adding LG-D838 in the model option list.

The steps are as follows:

0. Backup your critical data. Flashing TOT will do factory reset automatically. All user data except Ext-SD will be erased.

1. Find and download the firmware exactly matching your D838 (16GB or 32GB model, HK or TW model), and the DLL file (or extract from KDZ).

2. Find and download old version F350 firmware such as F350K 10d version (only old versions are compatible with ioroot24 method).

3. Download my sample TOT header file below (myboothdr.bin). This file is verified on D838 16GB Taiwan. May not work for 32GB version.

4. Download any KDZ/TOT extractor you like.

5. Download any CRC32 checksum program you like. I use HashMyFiles. And download any hex editor you like. I use xvi32.

6. Extract D838 firmware to get PrimaryGPT.bin (partition table), boot.bin (kernel) and the DLL file if KDZ.

7. Extract F350 firmware to get boot.bin. Rename it as boot350.bin

8. In Windows command prompt, combine PrimaryGPT.bin and boot.bin into d838body.bin by the following command:

copy /b PrimaryGPT.bin+boot.bin d838body.bin

Don't forget the argument "/b". It's very important to use the flag to do "binary mode" copy.

9. Calculate d838body.bin CRC32 checksum by your checksum program. This should be a 32-bit nubmer.

10. In sample header file "myboothdr.bin", Fill the CRC32 value at file offset 0x08. Please note that the file store number in little-endian order, so the byte order of the 32-bit CRC32 value should be reversed. For example, a calculated CRC32 value 0x12345678 should be filled as 78 56 34 12 in file offset 0x08, 0x09, 0x0a, 0x0b.

11. Combine header and body by the following command (the result file must be in "tot" file extension):

copy /b myboothdr.bin+d838body.bin d838kernel.tot

12. Repeat steps 8~11 but replace boot.bin with boot350.bin and d838kernel.tot with f350k4d848.tot.

Now you have two kernel TOT files for your D838.

13. Use LG Flash Tool to flash f350k4d838.tot with your D838 DLL ffile.

14. Manually run adb command similar with ioroot24 for F350. However, unplug and plug USB cable did not work for me. Switching between "Changing Only" and "MTP" works.

15. Use LG Flash Tool to flash back d838kernel.tot with your D838 DLL file.

The file "myboothdr.bin" contains some offset / size values which may not work for other region and/or 32GB D838. Make sure the size of boot.bin is 12058624 bytes. And try to investigate your partition table file PrimaryGPT.bin to make sure "boot" partition starting at 0x40000.

It is assumed that all 16GB models have the same partition geometry and same size of kernel image (boot.bin), so I GUESS all 16GB D838 could use this header file. But I am not responsible to this. To custom the header file for you D838 16GB or 32GB model, check the following items and modify the header if necessary:

1. Check you partition table file (PrimaryGPT.bin) to find the location of your kernel image partition. In D838 TW model, the kernel partition entry is at offset 0x700 (totally 0x80 bytes, 0x700~0x77f), offset 0x700+0x38 contains partition name 0x62,0x00,0x6F,0x00,0x6F,0x00, 0x74,0x00 (UTF16-LE string "boot"). And offset 0x700+0x20 contains kernel partition starting sector 0x00, 0x00, 0x04, 0x00 (32-bit number 0x00040000). If your D838 model has different value from 0x00040000, please modify my header file offset 0x2020 to your value.

2. Verify the files size of you boot.bin (and boot350.bin) to make sure if it is 12058624 bytes (0xb80000). If not, please stop here. Some calculation is required to modify my header file, and some partition size verification has to be made for your case.

Because the resulting tot files contain partition info and kernel image. You'd better use your own tot files. If you want to use others, please make sure it's for the same model, kernel version, ROM size (16 or 32GB), and region (TW, HK or SG).

Thanks:

autoprime's great ioroot tools