yashsingh1/xdaforums huggingface dataset:
[G4 General] antus:
@ asaf400: nice work! :)

[MENTION=5899743]Shadicbypass[/MENTION] yes, I read that, but I dont think that prevents us improving this method, just re-distributing their files.

As I understand it, they used send_command.exe which was created by blog.lvu.kr to get backdoor access and found that the main block device was accessible and then calculated and provided the partition offsets. Nice work to them on this.

They then used public files from supersu by chainfire to root those images. As they built the images I understand that they can request we not re-post those images but as the send_command.exe and supersu are both freely available from other sources I think we can use them and create a new wrapper to read/root and reflash our own system.img files from a pc (either full linux install or live linux image). Such a tool (provided it also keeps a backup of the unpatched system.img) would be a lot safer for users and prevent mis-matches occurring on similar but different hardware or from different carriers, and would also prevent typos damaging other partitions. It could also include a revert to backup option.

Anyone considering investing the time to do this, please do so! Just respect the original authors in this thread and dont package or re-distribute their pre-rooted system.img files. This low-effort root was good and has got us started, but were due for a medium-developer-effort root now to tidy it up and make it safer.

I have the notes from when I rooted my own phone, its only a handful of commands that need a linux gui wrapped around it. Happy to provide to anyone with time and interest to make such a tool.
[G4 General] iamtha1:
Omg i sure hope this becomes available on h810 att variant... Then i wont care about the bootloader
[G4 General] workdowg:
I was totally infuriated when someone went ahead and plagerized their work with bump. I am surprised they even released this because of that. I hope they will provide us with a better solution in time. But, I really wouldn't be hurt if they did it somewhere else for a fee, I'd gladly pay for their work and do donate when I can.

From my LG-G4, Rooted running Stock 5.1
[G4 General] oile:
Waiting for this image! :)
[G4 General] schneidz:
is this file (LGUnitedMobile_Win_Driver_Ver_3.14.1.exe) the same thing as android-tools ? or is there a specific lg version of adb and fastboot ?

also what is Send_Command.exe ? seems to be the windows version of dd so we dont need it, rite ?

zenity perhaps, what are the commands you use ?
[G4 General] antus:
The LG windows drivers are just the windows drivers, no tools, no adb, no fastboot.

send_command.exe is from blog.lvu.kr and is a tool that connects to the diag serial port that appears in windows when the phone is in download mode and provides a root shell with recovery selinux context. enough to perform the documented root.
[G4 General] Shadicbypass:
If you do that though you will not get anything else new that is in the kdz like drivers and kernel
[G4 General] antus:
That is a good point. Personally ive not turned off OTA, and I want it to tell me when an update is available. But after talking to a workmate with a nexus 6 he pointed out how once rooted OTAs probably will no longer install because they are shipped in patch format to existing files. Researching the issue I see this is correct. Its clear that if system files are modified patches to them will fail. People are saying that if you dont install xposed framework and the like you will be ok.

From rooting my phone, I know I moved app_process64 to app_process_init. I think this is likely to stop the patch finding and patching the real app_process64 and I think OTA will fail!

So.. my plan is to wait for the OTA notification try it and see what happens then if it fails restore my original unrooted system.img which will match my carrier OTA. Then let it update and provided the download mode shell access is still present (i kinda expect it to be) do it all again. As its a carrier phone I probably wont ever get any kdz and will need to be able to take the OTAs to stay secure.
[G4 General] oile:
What do you mean? Of course kernel, system, baseband etc will remain the same as mine v10c(d) euro version
[G4 General] Shadicbypass:
I was half asleep when i responded. I did not realize you were replying to a quote
[G4 General] schneidz:
thanks (thumbs-up), so its basically a linux emulator therefore they are not needed if you are using something like fedora ?

thanks, i dont have windows and i dont have a fone to experiment with yet.
[G4 General] antus:
No, there is no linux emulator. Linux runs on the phone (android is based on a linux kernel). The drivers allow windows to recognise the phone and create the right com ports. This is needed for send_command.exe on windows.
[G4 General] Vinucci:
Thanks, I am definitely interested :good:
[G4 General] schneidz:
thanks again, i skimmed up to page 117 of this monster. seems like someone created a bash script to backup the fones system partition, copy the su .apk to it, then restore the rooted backup overwriting the stock system partition.

the LGUnitedMobile_Win_Driver_Ver_3.14.1.exe/Send_Command.exe/ports.bat/... stuff was confusing since dd is a standard linux command and that is essentially all that is needed (unless i am grossly underestimating things (as is my wont)) ?

i think it would be easier to just create a live-usb of some distro if someone doenst have linux installed on their pc.
[G4 General] biff6789:
Thank you. Any chance you could elaborate a little further on how you exactly did this?

While not exactly root related, I think a lot of people are watching this thread to see if somebody successfully hijacked this root method to install the Xposed files instead of the root files, and it looks like you did.

Would you mind posting a step-by-step on exactly what you did here?
[G4 General] AvivEliyahu:
What script did you run in order to inject xposed files to the image? since the given script is injecting the superuser files.. will be glad to get some help (also, i guess youre from israel by your name? so helping in hebrew will be great.)
[G4 General] asaf400:
Uploaded Successfully :)

Also if someone is still on 10b and wishes to go with rooted \ rooted&xposed 10c with flashing only the system.img and boot.img for 10c

but not update through a complete KDZ,

here's the necessary boot.img to retain exFAT support, [ H815 EUR ONLY! ] Flash it with flashily from the internal storage, reboot, and you now got back exFAT

The install script within the flash-able .zip file for arm64-v71 xposed build, I've just extracted it (META-INF folder)

The thread to get the zip was included in my original post, but here you go

Again I've setup my environment to mimic a recovery environment, and then I could just easily run the script..

it's the zip named: xposed-v71-sdk22-arm64-by-romracer-20150816.zip

And Yes, I also guessed you are Israeli, so pm me in Hebrew if you get stuck \ do not understand..

Note that I've bought the Europian H815, and the Israeli LG G4 is H815

L
[G4 General] AvivEliyahu:
if ill place my system.img with the extracted files from the xposed.zip and run the flash-script.sh file will it inject it or not? im confused :confused:
[G4 General] maelever:
please help me!!

" dd " is not recognized as an internal or external command ,

operable program or batch file .

I do all and in point 9 I set the COM port and type "ENTER"

CMD

C:\Users\marco\Desktop\LG_Root>Send_Command.exe \\.\COM6

Author : blog.lvu.kr

SPECIAL COMMAND : ENTER, LEAVE

#ENTER

C:\Users\marco\Desktop\LG_Root>ID

"ID" is not recognized as an internal or external command ,

operable program or batch file.
[G4 General] schneidz:
i think the part that i am missing is that the fone doesnt present itself as a storage device to the pc even under download mode (is that correct ?). therefore dd wont work if there isnt a /dev partition to image ?
[G4 General] antus:
dd is allready on your phone and runs on your phone.
[G4 General] jaxbierley:
[IMG="Enable OEM Unlock"]http://imgur.com/W4odVc7[/IMG]

[MENTION=2684188]autoprime[/MENTION] So I have the option for "enable OEM unlocck" on my Sprint G4. I've clicked it nothing happens. Before I try fastboot oem unlock I was wanting to make sure there was no risk or if it would do anything at all.
[G4 General] tomgreen99:
What code do I type in to execute root???
[G4 General] Bill Gamble:
Wrong thread.
[G4 General] DonJuan692006:
At what point did the instructions say to type "ENTER"?
[G4 General] yolkah:
I have the H815k variant of the G4 running on 10c, have successfully rooted it with the international 815 img file but have lost exfat for the ext sd card in the process. I have backed up the stock 10c image file before rooting, can someone root the stock image file seeing as to how there's little or no mention of the H815k variant in this thread.

Edit - Followed the instructions here and injected root into the backup image file. exfat and root seems to be working fine.

http://xdaforums.com/g4/general/lg-g4-dual-sim-models-h818p-h818n-t3115759/post62097182#post62097182
[G4 General] schneidz:
i am able to create a dd image of the /system partition on an lg mach. i mounted the backup and touched a test file. but i get operation not permitted when trying to restore using dd.
[G4 General] maelever:
I'm stupid. sorry
[G4 General] HTCuser90:
Can you make systemroot for G Stylo LS770 Sprint 5.1 ? I can dump.
[G4 General] DonJuan692006:
Lol....no worries man, glad you got it figured out.
[G4 General] asaf400:
1. Have an Ubuntu (I've used a vmware workstation for an ubuntu VM)

2. Copy You're rootedsystem.img to it

3. mkdir /system

3. Mount the rootedsystem.img to /system (by doing that you've just created an 'android recovery like environment' as the xposed install script only reffers /system)

4. Have the flash-script.sh and the system folder within the xposed zip in THE SAME folder in ubuntu - Mine was /home/<User>/Desktop/LG/

4.1 Ensure you're shell is in the script's folder - if not use 'cd' to be there..

4.2 Now do 'ls -l' or 'll' In this folder, You should now have:

4.3 The File flash-script.sh (do a chmod +x on the file :) )

4.4 The Folder 'system' (which contains the files that the install script copies over to /system, which is now are mounted image! :) )

4.5 Run The Script!

5. when it's done, unmount,(and optilnally rename the .img to distinguish it from a regular rooted image because it now has xposed...)

6. Copy the image to the Phone's internal storage

7. Reboot into Download mode and use send_commands.exe to flash the image back to the phone with you're phone's dd command

7.1 (see 1st page to know which command is relevent to you're model) and also use the .img name you used, i used the name rootedxposedsystem.img

8. Install The latest xposed framework app (Alpha 4, or it would not work!! )

9. Done! (really done, lol, unlike the root guide [Unless I've missed something :) ...])

I'm sorry i cannot explain this from step 0 to the final step in detail , I'm busy during the workweek, and that's why I just posted guide line on how to do it,

As did other people suggested this method, but they did not try it or did not report on their attempt, I Did it, on my own, and posted a quick 'successfully done' you should try it you'reself kind of post..

I hope the quickly put together 'guide' above is enough for now..

I'll post a Detailed and Well written Guide on a New Thread in the coming days, but please note:

IF someone wishes to do so, i mean post a step-by-step guide by understanding my instructions (those i've posted in partial segments)

on the ways to install xposed using my rootedxposedsystem.img or do it on their own by 'Injecting' the files into the mounted system (on ubuntu)

I'd Approve it, But Please Credit me for the attempt and report that it works and meloos for the idea
[G4 General] schneidz:
i tried this on an old lg fone but the fones partitions arent seen by the pc while the fone is in download mode (are newer lg's different ?). when you are using the dd command are you running it within the system-command.exe emulator (windows ?) thingy ?
[G4 General] asaf400:
Yes, Revised:

7. Reboot into Download mode and use send_commands.exe to flash the image back to the phone with you're phone's 'dd' command

7.1 (see 1st page to know which command is relevent to you're model) and also dont forget to use the .img name you copied, I used the name rootedxposedsystem.img
[G4 General] HLyons:
Something is wrong with the VZW file. When I download its only 4mb, not 1.7GB. Anyone else experience this?

---------- Post added at 05:53 PM ---------- Previous post was at 05:50 PM ----------

Correction its 4KB not MB.
[G4 General] RenaKunisaki:
You need Send_Command.exe to tell the phone to run the dd command. It has nothing to do with the dd on your PC.

Send_Command.exe is a specialized program that connects you to the Linux shell running on the phone in download mode. You need it to run commands such as dd on the phone. It has a full Linux system on it already; this tool just gives you access to it in a mode that (for some reason) allows writing to the system partition directly.
[G4 General] HLyons:
Maybe its just the network I'm on. I'm attempting to download on the phone via 4G connection and while slow as hell it looks like its attempting to download more then just 4KB
[G4 General] RenaKunisaki:
"Enable OEM unlock" doesn't do anything on its own. Unlock tools are supposed to check that setting and refuse to proceed if it's not checked. That way if someone steals your phone they can't bypass the lock screen by unlocking the bootloader and just deleting/replacing the screen lock app.

For what we're doing, it's not relevant, since the download mode backdoor doesn't look at it.
[G4 General] PalmCentro:
View attachment 3444657
[G4 General] HLyons:
Must be something on my work network killing it. Thanks
[G4 General] schneidz:
thanks, just for shiggles, what does:

mount | grep /system

yield (maybe seek/skip/count parameters are unnecessary) ?
[G4 General] HLyons:
Would you be able to host it on google drive or something after its done downloading for you temp........Downloading on my phone is taking a REALLY long time.
[G4 General] Usraek:
Please check the first and second post of this thread, it has all commands and images required.
[G4 General] RenaKunisaki:
In the download mode/Send_Command.exe? It won't work. It's a very limited shell which only splits strings at each space and passes it to execvp(). So redirection operators like < | >, as well as quoted strings, won't work. It would pass the parameters "|", "grep", "/system" to the "mount" command. Further, it doesn't connect stdin or stderr to the command, so you can't even see the error output or execute a real shell.

I suspect it might be possible to execute a shell script which will set up stdin/stderr from the parent's /proc/xxx/fd and provide a real shell, but I haven't tried. (Has to be a script because anywhere we can push a binary is mounted noexec, but AFAIK "sh blah.sh" ignores that, since it's technically only reading the file, not directly executing it.)

As far as not needing the seek/count parameters, I suppose you could try of=/dev/block/mmcblk0pXX (XX=whatever partition your /system is), but I think it won't work. (If it worked, why wouldn't the original method use it?) I think selinux prevents direct access to the partitions, but not to the underlying flash device (a nice oversight).
[G4 General] Vinucci:
Thanks for the upload asaf400, Xposed working perfectly ?
[G4 General] schneidz:
thanks, still curious. what does

mount

yield ?

edit: also running the commands using something like connectbot or adb shell or sshdroid would give the needed info (but it seems like the dd would need to run over system_commands.exe).
[G4 General] antus:
Ive covered pretty much what your getting at earlier in the thread here. The limits are selinux, once rooted (with init context) you can see and do a LOT more.

I did not show mount, but it shows system is mounted read only, and selinux prevents remounting it RW. You must go through the main block device with offsets to access the partition.

http://xdaforums.com/showpost.php?p=62272411
[G4 General] schneidz:
this is what i was looking for:

#ls -l /dev/block/mmcblk0p47
brw------- root root 259, 15 2015-01-13 21:22 mmcblk0p47

i was gonna' propose something like:

dd if=/dev/block/mmcblk0p47 of=/sdcard/backup.part

but i guess we'll get permission denied.

wishful thinking: maybe there is a kernal param that can be set at boot time that will disable selinux (i had to do that in fedora awhile back for some reason using grub).
[G4 General] nipun1110:
Need urgent help

hey, i am stuck in bootloop while testing gravitybox in xposed. can anyone help me out please? i dont know what to do. i was using a rooted LG-815T. please give some urgent reply.
[G4 General] antus:
If you are doing root this way, its because you have a locked bootloader and cant get access to the boot params. If we could, then there would be many options. And we cant patch the bootloader because its signed.

I did wonder briefly if we could swap in an older bootloader from another phone which is signed by LG that doesnt have a lock, but likely hood of that working is low as it probably wouldnt support this hardware well enough to boot. Also, even though we can overwrite aboot once we have root if it bricks we dont have jtag or anything to recover. So I aint trying it. The bootloader is in the parition aboot and can be ripped once you have a rooted phone. Ida can load it. Its closely based on android lk "little kernel" which gives you a bit of a map around, but so far it looks like it does proper public key checking and there is no silly code we can exploit. If your interested my aboot.img is attached. Its similar to https://android.googlesource.com/kernel/lk/+/b42836029ffba42d4d5b6dd6fb7e136cd5cd418e/app/aboot but the security has a lot of modifications by LG.

There is also some info about the boot process here http://newandroidbook.com/Articles/aboot.html
[G4 General] Fma15:
never mind. Can a mod delete this?
[G4 General] aaronrw:
Anyone have an idea on this?
[G4 General] Bill Gamble:
http://xdaforums.com/showthread.php?p=62167311
[G4 General] schneidz:
another dumb question, what does this program do: LGUnitedMobile_Win_Driver_Ver_3.14.1.exe ?

my fedora pc is able to connect to my old lg's without it. does the g4 now require windows (e.g.- ifone requires itoons) ?
[G4 General] antus:
See answers on page 185.

Note that multiple com ports appear, including the diag com port. This is not generic MTP or usb storage access (though the phone , supports MTP etc). This is debug/firmware flash level access. Maybe you dont need it and all com ports appear and maybe send_command.exe runs on fedora under wine? Suck it and see. And let us know.

Actually, just plugged mine in to this EL7 machine with the charger cable :P

Aug 20 11:35:17 ant kernel: usb 3-7: new high-speed USB device number 65 using xhci_hcd
Aug 20 11:35:17 ant kernel: usb 3-7: New USB device found, idVendor=1004, idProduct=633e
Aug 20 11:35:17 ant kernel: usb 3-7: New USB device strings: Mfr=1, Product=2, SerialNumber=3
Aug 20 11:35:17 ant kernel: usb 3-7: Product: LGE Android Phone
Aug 20 11:35:17 ant kernel: usb 3-7: Manufacturer: LG Electronics Inc.
Aug 20 11:35:17 ant kernel: usb 3-7: SerialNumber: LGH815xxxxxxxx
Aug 20 11:35:17 ant mtp-probe: checking bus 3, device 65: "/sys/devices/pci0000:00/0000:00:14.0/usb3/3-7"
Aug 20 11:35:17 ant mtp-probe: bus: 3, device: 65 was an MTP device

So... it seems you do need it, and windows for the diag com port.
[G4 General] schneidz:
i meant for general use (copying music, videos, ...). but from your answer i see its only needed to make the diagnostic ports visable.

i am unsuccesful getting my pc to talk to it in download mode:

www.linuxquestions.org/questions/li...error-module-usbserial-is-builtin-4175551166/
[G4 General] antus:
Download mode is for LG engineering to reflash firmware when phones are returned with software problems. We use it to root. For getting files/pics on and off, use MTP mode. That does work fine on linux. See your phone manual for how to put it in to MTP mode if it is not, this thread is about rooting. Essentially plug it in, and you should get a message about what mode USB is in as a notification on your phone. Select that option to change the mode (if, say, its on charge ONLY. But MTP should be the default. See from my post where it says "bus: 3, device: 65 was an MTP device" -- thats Media Transfer Protocol (I think).
[G4 General] amrmorsy:
Download mode driver failed

Hi all,

I searched and searched, can anyone help me with my driver installation. All drivers are successfully installed except "Android LGE MTP" Driver when the phone is connected in Download mode!!!

I get Error: Device Cannot Start: Code 10

I uninstalled and reinstalled the LG drivers and tried different sources to download the drivers from 3.14.1 and no vice!

Please help...

Thank you
[G4 General] RenaKunisaki:
I got an error like that too, but I just ignored it. It just seems to be saying it can't find the driver for a certain function, but we don't need that function anyway. As long as the DIAG port shows up in ports.bat it should work fine.
[G4 General] OGIGA:
Anyone rooted able to encrypt their phone? I can't...
[G4 General] player911:
Process worked great!

Except I didn't see the "Backup your existing SYSTEM image to internal storage" until the 3rd post and by then it was too late.

I would think this step would be done BEFORE flashing the new one, or at least make mention of it.
[G4 General] AUSTAB2012:
My current version is. V10c-505-02 im on a H815T optus. In Australia. Will this merhod work i cant seem to find a matching version to download
[G4 General] Fma15:
I have an h812. Do I need to download a spesific tar.gz file or do I just get the International H815 10c Version? I assume I need a spesific one, so if I do can you give me the link, I can't seem to find it.
[G4 General] daClaus:
You did read this in the first post, didn't you?

Further questions?
[G4 General] Nytronx:
Hello

I have an lg g4 h815 running v10c-EUR-XX, I want to root it.

Should I use the official method with the official bootloader unlocker from lg or this method ?
[G4 General] cerps:
I get the same error. Ports.bat will work and produce the diag port. I can run the send command and get the hashtag. But when I type "id" nothing happens. It just sits there. I've ctrl+c and tried again and again. I can't get the "uid=(0)root gid=(0)root" to show up thus can't enter the dd command and no root. I've uninstalled and reinstalled LG drivers multiple times. I can get the debloater tool to block OTA's and such but can't get this to work. I've searched and tried multiple suggestions out there to get it to connect. The only thing I haven't done is messed with the registry because I don't want to pile up my whole computer just to root a phone.
[G4 General] schneidz:
similar experience as mine:

http://xdaforums.com/android/develo...lg-devices-t3049772/post62425954#post62425954

it may be those programs are device specific (i dont have a g4).
[G4 General] karendar:
The H812 version is the Canadian variant, correct? Which carrier do you need?

Go on the general page, look for the Canadian thread and go to page 30... Around that time, I've posted all the info for the different carriers.

https://www.androidfilehost.com/?w=files&flid=36116

Here's all the Canadian carriers that were supplied to us wih their rooted system partition.

Thanks!
[G4 General] jmileti:
Yes it should. I did same thing.
[G4 General] karendar:
Didn'T notice if someone answered you. Look on the Canadian thread on page 30, I put in the commands to extract/flash.

Thanks!