[Android General] zefie:
No. LAF blocks sh on this device, so the part where this guide tells you to run

sh /data/local/tmp/lg_root.sh dummy 1 /data/local/tmp/UPDATE-SuperSU-v2.46.zip /data/local/tmp/busybox

is going go fail with "Hello, I am LAF! Nice to meet you!", which is basically LG telling us to f off.

I know this is all dev talk but to try to simplify it a little bit, "LAF" = LG Advanced Flash or whatever, aka "Download mode". The rest is for devs, but end result is I have not found a way to root or modify this device yet.

Begin dev talk:

I've been researching this "LAF" and am wondering how much we could even do. From what I learned, I was able to pull partitions from this device (which were subsequently rendered pointless when I found a tot). That said, we cannot write anything to the device. We can read the entire chip (wait, so this is for "user security" but we can read the data? Ha, its for carrier security), but all writes are in some sort of test mode, where it will report it wrote successfully but it really doesnt.

Interestingly enough, I learned the LAF might not be able to even flash a tot even if we had the DLLs and such. So when LAF boots, it looks on the SD Card for "LG-M153/xboot.tot", which it will try to autoflash. However, reading the logs, I noticed even this fails when LAF tries to check the existing partitions, SELinux will block lafd.

More dev info for this device:

TOT can be found here, or by Googling "LGM153AT-00-V11b"... No known working LGUP DLL is available.

LAF is v1.2, protocol version 1.0.0.4

LAF boots in "633A" cable mode. This can be set to "USER" via a specially modified props command, but doesn't change anything. I cannot find any information as to what a "633A cable" is, but I assume its a factory proprietary thing.

LAF initrd does not even contain "sh" or any shell, though it does mount /system.

LAF initrd does contain an adbd, but its init is commented out in init.rc. But again, no shell program...

LAF EXEC commands are limited to: "ls", "ps" "dmesg" "mkdir" (but doesnt really make a directory), "umount", and "getenforce" (returned "Enabled"). ANYTHING else will return the Hello message. Since I can dump partitions I did dump LAF and ran strings against lafd. "grep" is shown in the area I believe is the whitelist of commands, but since the binary is not available it will fail.

About the SELinux thing, I put a full tot on the SD card as the file it looks for, and it picked it up but failed at "Checking partition: tz" "Real partition: "tzbak", then SELinux error declining lafd access to read said partition.

lafd is also blocked to "boot", "recovery", "aboot" and any respective "bak" partitions. lafd does, however, have access to the "laf" and "lafbak" partitions.

DO NOT REMOVE LAF PARTITION ON THIS DEVICE. You ask "how can you do that if you can't write?" Well, by some genius at LG, you cannot WRITE data, but you can ERASE it. the LAF "ERSE" command WILL WORK. You will get a fastboot but its NOT WHAT YOU THINK. This fastboot is utterly useless, it cannot "unlock", it cannot even flash. It can pretty much just reboot. I could not flash back a backup of LAF. Yes, "OEM Unlock" was enabled. DO NOT TRY IT, you have been warned. The copy of "fastboot" is built into the bootloader, aboot.bin

Anyone with an AT&T LG-M150 may be interested in whatever developments we come up with. Its practically the same device.

Any developers who are interested in working with me on this device, PM me or reach out on twitter (same username)

Possible exploit paths (devs only):

Continue to scan tot files to find an exploit in the bootloader or installed binaries.

LGUP with "Common" DLL can NOT work in "Refurbish" or "Upgrade" modes, it can however push and trigger a FOTA update. If we could manipulate this...

I cannot find much about this "xboot.tot", maybe its not meant to be a full tot, but just a boot tot? Are there such things as mini tot files? If we could boot our own abootimg...

As stated above, lafd has limited access due to SELinux, but it does have access to the "laf" and "lafbak" partitions. Perhaps if we could figure out how to write, we could overwrite laf with a SELinux permissive (or modified permissions) version of itself to go further.. Risky though since if our laf doesn't boot we are SOL.