yashsingh1/xdaforums huggingface dataset:
[G4 Q&A, Help & Troubleshooting] fpsq:
http://postimg.org/image/l92gw7u3l

I forgot the hashes. Just double check to make sure!

7260 files pulled. 0 files skipped.
2641 KB/s (3432824494 bytes in 1269.235s)

LGG4System

CRC32: 86669799
MD5: 3A61221A7D724C2BDD59A87ED731727F
SHA-1: 820104CA46885B9E99646D6465B9D65B5AE92809
SHA-256: A5CDE64FDC80F5BE849011F498391B7C25AA1966AD4E8320CBA05D36BCBFB49E
SHA-384: 0D612C2F0C7281C96468F60833BA8A9920FD5F8C81CE2A1F26454173BFFAA38332E5CA8BCB41640EFF6AB8DE75B0F833
SHA-512: 64282E33C31827BECF40639333D9025DB513F00607F6A3C1E71C7518B1F1B40EF1D340826C74B7D75DB27166B24BA4D0016CADDEF7D477E222BF3E54A973FCD1
[G4 Q&A, Help & Troubleshooting] datvu:
HI I have some questions about unlocking bootloader. If I root my phone and backup DRM partition. Can I lock bootloader with restore of DRM partition ?
[G4 Q&A, Help & Troubleshooting] fpsq:
Any news? Did the system pull provide any insight?

Sent from outer space using telepathy
[G4 Q&A, Help & Troubleshooting] Shadicbypass:
Honestly not really but could you try backing up the laf partition with a root backup tool on the play store and uploading that. It is only a few megabits

I recommend this tool

https://play.google.com/store/apps/details?id=ma.wanam.partitions
[G4 Q&A, Help & Troubleshooting] KonterBiER:
The entropy of the payload is 7,14 of possible 8. This means there is no logic in this data. It has to be encrypted or is a checksum of something.

Do we have few different unlock.bin files?

If we have luck, and they used RSA, it looks like they used only 1024 bit modulus (resulting in ~256 byte ciphers). This should be factorable in acceptable time.
[G4 Q&A, Help & Troubleshooting] Shadicbypass:
Ok so it has been a while since i posted in this thread but the system pull did not really provide any insight but i did manage to crash my lg g4 during the last week and was able to fix it because of the system img pull that was done.

To fpsq: I would also like to ask that you download partitions backup and restore by wanam on the google play store and backup your laf partition and upload it to compare to mine because you have unlocked your phone and mine is locked because i have the sea h815 variant.
[G4 Q&A, Help & Troubleshooting] Shadicbypass:
Can someone with a unlocked bootloader try backing up the laf partition for me
[G4 Q&A, Help & Troubleshooting] Shadicbypass:
Okay i dont know if this helps but i have a copy of almost all the partitions on the lg h815 eu before and after unlocking the bootloader along with the unlock.bin that was supplied by lg and used to unlock. Will upload all the imgs and the unlock.bin in a zip later.

I got the partitions from a friend who has the eu variant and wanted to unlock his bootloader.

Edit: here is the link

https://drive.google.com/file/d/0B3zD7J4qFcyadm16UC1SREpDUEE/view?usp=docslist_api

Sent using XDA One
[G4 Q&A, Help & Troubleshooting] norad73:
I have tried to generate my own "unlock.bin" from the LG developer website by I am getting a "Service Unavailable" error continuously. I have sent an email to developer@lge.com and am waiting instructions. In case they never respond, can I use one of the unlock.bin files in this thread or are they locked to IMEI/device ID ?

Thanks,

Alex
[G4 Q&A, Help & Troubleshooting] Shadicbypass:
Pretty sure they are locked to each phone.
[G4 Q&A, Help & Troubleshooting] norad73:
Found out what was wrong. The error message "system unavailable" does not say much, so it was a wild goose chase. Anyway, I tried a Dutch VPN and tricked it into thinking I was in the Netherlands, and it worked! LG sent me my unlock.bin ! Hurray!
[G4 Q&A, Help & Troubleshooting] xrad:
Just in case someone with some spare time and crypto skills is still listening here.... there is a bounty to be claimed for the first one to get us a generic unlock method.

>>>> Claim it here! <<<<
[G4 Q&A, Help & Troubleshooting] xrad:
So I've been looking at MM20B's aboot.img today. I was able to extract a number of keys and certificates, find them here. They're all in DER format (ie. binary). Unfortunately I'm not a crypto expert, but perhaps one it out there reading this.

Dump keys like this:

openssl asn1parse -inform der -in KEYFILE

The rootca and one of the "LG attestation" certs are x509:

openssl x509 -inform der -in lgroot.crt
openssl x509 -inform der -in lgattest.georgia.crt -text

Here are some thoughts and observations I made:

Funniest one first, one x509 certificate has a CN id of "georgia.park" which seems really odd, perhaps even a hint to some pass-phrase?

The androidlk keys seems to be related to the Android Little Kernel boot loader code.

On of the keys is is named UNLOCK_RSA_02, I'll be damned if this doesn't have to do anything with unlock.bin

I could imagine that the unlock.bin is encrypted with a public key at LG's site. Then you flash it to a dedicated partition. aboot.img grabs unlock.bin, decrypts it with one of its private keys and checks it. I could imagine if we get to decrypt an existing unlock.bin, it just contains the device id and IMEI.

More generally, I think the process and keys is independent of the phone hardware. Every phone has to have identical boot loader and verification code. They will use the (unalterable) device id and IMEI to bind the process to devices

Next steps could be:

give those keys some more meaning and relate them to each other / other artifacts

most likely the unlock key is encrypted, so we'd need to find the pass phrase

some ARM guru could try to disassemble aboot.img to learn how those keys are used. Perhaps even find additional pass phrases embedded in the code

Spread the word. I'm new to the LG/LG4 community but I already learned that guy [MENTION=2684188]autoprime[/MENTION] is doing lots of gory work. Let's jailbreak this together and then donate the bounty to some noble cause!
[G4 Q&A, Help & Troubleshooting] Shadicbypass:
In the build prop the ro.build.user is geprgia.park
[G4 Q&A, Help & Troubleshooting] ABotelho23:
I love to see people go at this stuff. Unfortunately my specialty is more networking, I don't know enough about this specifically to help as much as I'd like!
[G4 Q&A, Help & Troubleshooting] ABotelho23:
While doing a bit of research, I stumbled on some particularly odd documents. Both documents have several mentions that are pretty specific about how LG secured the bootloader. I have no idea if it's handy, or if it's already been posted, by I figured what the heck!

https://drive.google.com/folderview?id=0B7oPC5i99NAZeXBOcnRZWk1ER3c&usp=sharing It's two PDF documents, both are in this shared folder of mine. Hope it helps!
[G4 Q&A, Help & Troubleshooting] xrad:
Here's a quick update. I've spent a lot of time reverse engineering the bootloader and I have now a pretty solid picture how things work. With the valid combination of an unlock.bin and device-id/IMEI I was able to reproduce the stages the code takes to validate the key. Indeed the unlock key I recovered from the binary is a public key which the loader verifies the unlock.bin key. It then compares the digest thus recovered with a locally generated one and if they match - you're unlocked. So far for the good news. As expected, the bad news is that the corresponding private key is not in our hands, but needed to create valid unlock.bin files. So as of now there's still no hope to break in, but at least I know how the lock works. And I learned a bit about openssl, which has its own merits.
[G4 Q&A, Help & Troubleshooting] ChriKn:
I assume that trying to bruteforce the key is not an option ?

Even if a huge amount of people as their Riggs to the process..
[G4 Q&A, Help & Troubleshooting] xrad:
I'm not a crypto expert, and I don't know the first thing about attacking keys. But from what I read about sha256 - no effing way on earth. It is much more likely that a frustrated (or noble?) LG engineer drops the private key somewhere... (such as in a box :angel:)
[G4 Q&A, Help & Troubleshooting] ChriKn:
Some of us must infiltrate LG, find a low-wage job to earn their trust and respect. In some years we might be in the position to get the key and voilà ;)
[G4 Q&A, Help & Troubleshooting] dpi295:
It's possible to access MiniOS on the G4. Used it previously to recalibrate the proximity sensor.

1. Type "277634#*#" in dialer to access the hidden menu.

2. Select "Device Test"->"MT", the device should restart.

3. It should reboot into Genesis MiniOS.
[G4 Q&A, Help & Troubleshooting] IllegalArgument:
Excellent analysis, all of the info you've shared looks accurate to me. I just had a couple notes I wanted to add regarding the device ID, IMEI, and ftm_get_item().

First, to compute the device ID, you start by reading the SoC serial number from QFPROM. The serial number is eight bytes long and is stored as two 32-bit words (in order): QFPROM_RAW_SERIAL_NUM_LSB at physical address 0xFC4B81F0 and QFPROM_RAW_SERIAL_NUM_MSB at physical address 0xFC4B81F4. Next, you convert the serial number to an uppercase hex string, i.e., sprintf(buf, "%08X%08X", QFPROM_RAW_SERIAL_NUM_LSB, QFPROM_RAW_SERIAL_NUM_MSB). Then you compute the SHA-256 hash of the hex string from the previous step. Finally, you convert the hash to another uppercase hex string, which becomes the 64 byte device ID used to form the unlock token.

As for the IMEI used in generating and validating the unlock token, it is not read from the modem, but from an ftm_item, as you noted. But what is an ftm_item? On LG devices, ftm_items are stored in the misc partition. Each ftm_item has an ID associated with it; for example, the ftm_imei item, which is used to generate and validate the unlock token, has ID 0xD. To compute the offset an ftm_item in the misc partition, simply multiply its ID by 0x800; continuing the previous example, this puts the ftm_imei item at byte offset 0x6800 in the misc partition.

While having the IMEI part of the token in the misc partition does give you easy control over it, the QFPROM serial number is quite challenging, since it physically cannot be modified. Downgrading the hash to SHA-1 instead of SHA-256 may be possible, but even SHA-1 isn't very fun to attack. That's not to say the scheme used here is unbreakable - there may very well be some weakness that hasn't been noticed yet. If there is such a weakness, analysis like that which you're doing is the best way to discover it.
[G4 Q&A, Help & Troubleshooting] xrad:
How could one alter the misc partition on an unlocked and unrooted system though?

Indeed. More eyes on the code would help though, so I would like to share my annotated disassembly of aboot but I'm unsure how to do that in a legally safe manner. Any advice?

---------- Post added at 08:25 PM ---------- Previous post was at 08:21 PM ----------

Very interesting! Yesterday I read about that (related to the G3) and remember people not finding a way out of this mode again? Is that still an issue? Haven't tried your codes yet.
[G4 Q&A, Help & Troubleshooting] dpi295:
You mean not being able to exit? I have not had any issues. This post has a short guide on navigating it (for the purpose of calibrating the proximity sensor) and also some screenshots of the OS.

Hope it helps! Appreciate the work you're doing :)
[G4 Q&A, Help & Troubleshooting] ericralph:
I mean not without a quantum computer... ;)
[G4 Q&A, Help & Troubleshooting] xrad:
For the records, on phone that code does not work. I found this one after a while: *#546368#*815#
[G4 Q&A, Help & Troubleshooting] dpi295:
My apologies, if you're on Marshmallow the code is different. This code is for G4s on Lollipop.
[G4 Q&A, Help & Troubleshooting] ciaobelliwua:
the code *#546368#*815# work on lg g4 H815 with MM v20A
[G4 Q&A, Help & Troubleshooting] amune14:
seg000:0000000000000000 ;
seg000:0000000000000000 ; +-------------------------------------------------------------------------+
seg000:0000000000000000 ; | This file has been generated by The Interactive Disassembler (IDA) |
seg000:0000000000000000 ; | Copyright (c) 2014 Hex-Rays, <support@hex-rays.com> |
seg000:0000000000000000 ; | License info: 48-3057-7374-2C |
seg000:0000000000000000 ; | Zhou Tao, Jiangsu Australia Sinuo Network Technology Co., Ltd. |
seg000:0000000000000000 ; +-------------------------------------------------------------------------+
seg000:0000000000000000 ;
seg000:0000000000000000 ; Input MD5 : 293445143C7460E5C823DA3512C58DBB
seg000:0000000000000000 ; Input CRC32 : F6A626E9
seg000:0000000000000000
seg000:0000000000000000 ; File Name : C:\Users\+шыют\Desktop\unlock.bin
seg000:0000000000000000 ; Format : Binary file
seg000:0000000000000000 ; Base Address: 0000h Range: 0000h - 0400h Loaded length: 00000400h
seg000:0000000000000000
seg000:0000000000000000 .686p
seg000:0000000000000000 .mmx
seg000:0000000000000000 .model flat
seg000:0000000000000000
seg000:0000000000000000 ; ===========================================================================
seg000:0000000000000000
seg000:0000000000000000 ; Segment type: Pure code
seg000:0000000000000000 seg000 segment byte public 'CODE' use64
seg000:0000000000000000 assume cs:seg000
seg000:0000000000000000 assume es:nothing, ss:nothing, ds:nothing, fs:nothing, gs:nothing
seg000:0000000000000000 db 9Eh ; Ю
seg000:0000000000000001 db 15h, 0B7h, 8Dh, 6Bh, 0D3h, 7Eh, 2Dh
seg000:0000000000000008 dq 200000001h, 64F1F1900000100h, 204B15C652FEAB37h, 0D373DFE9DB6ED2E4h
seg000:0000000000000008 dq 0C5871456D523F189h, 8C2ECC2AFCC96969h, 0AE377CD7EDFC591Ch
seg000:0000000000000008 dq 0D9699210D2DF5325h, 0F417563C1FCE974Eh, 8BD500816BADD90Dh
seg000:0000000000000008 dq 0B6A76C5DB29B1540h, 9264C8141FE4BD4Eh, 5933C7C5DB86DAB8h
seg000:0000000000000008 dq 0A281ED79F2D73B6Bh, 30892075905D0E19h, 0B131F2AA154D942Bh
seg000:0000000000000008 dq 0D8B351873A3F03EBh, 1E6165A5DA67E3B5h, 29AE549074A3CF76h
seg000:0000000000000008 dq 7666109352D75814h, 515A79F656A631FAh, 0FDDA48CB6B404905h
seg000:0000000000000008 dq 352DE0CCF66CD1h, 5456C8BD8249DF7Eh, 99D09202775E8F74h
seg000:0000000000000008 dq 0B8952F012EE0BDD4h, 1E9C96F18C59330Eh, 9C51492CB41804Bh
seg000:0000000000000008 dq 5922EA9952CC2F68h, 6CF3B16C50B1A007h, 7031925C78AB4B29h
seg000:0000000000000008 dq 60DB139BDF82A203h, 27BE1E0D203B6155h, 986D71CAh, 5Dh dup(0)
seg000:0000000000000008 seg000 ends
seg000:0000000000000008
seg000:0000000000000008
seg000:0000000000000008 end

This is disassembled unlock.bin
[G4 Q&A, Help & Troubleshooting] ABotelho23:
Make anything of it?
[G4 Q&A, Help & Troubleshooting] xrad:
As explained in detail earlier, unlock.bin is a signed hash. Disassembling it does not make any sense at all.
[G4 Q&A, Help & Troubleshooting] KonterBiER:
It's useless, because the unlock.bin doesn't contain machine code (at least not as plain text).
[G4 Q&A, Help & Troubleshooting] xrad:
Reiterating, to avoid future myths: Unlock.bin does not contain any code in any form. It is a signed hash of your device id and the IMEI, both of which are unalterable on your phone. The signature is verified using a public key built into the bootloader.
[G4 Q&A, Help & Troubleshooting] maydayind:
HTC alsow use unlock.bin files to unlock. But with my HTC sensation u had to short a circuit on the mainbord to be able to open som port u could exploit. Maby there is a similar solution to this bootloader
[G4 Q&A, Help & Troubleshooting] ChriKn:
Would there maybe be a way to "inject" an inscure bootsequence (while not touching the locked bootloader) to do some stuff ? I remember this being the case on prior xperia and HTC devices. Not to say it would be easy...
[G4 Q&A, Help & Troubleshooting] xrad:
There is a chain of trust formed using security keys, right from power up. The component called aboot is the first one which may choose to break this chain, and it is aboot that does the unlock.bin checking. If it finds a valid unlock.bin, it will break the chain, and this what unlocking actually means. So as of now, no, I see no way to inject anything at this stage. If we could, yes indeed that would be perfect, because then we could forge an aboot which pretends an unlocked device. But without keys, it's pretty tight right now.
[G4 Q&A, Help & Troubleshooting] ChriKn:
So, we are pretty screwed if we don't find a major vulnerability or if a nice employee doesn't "leak" some helping bits... How long would bruting the key take ? Would the bounty be enough to run a script on an Amazon server i.e ?
[G4 Q&A, Help & Troubleshooting] Leavard:
Assuming that the key is the same for all devices/variants...

Seriously though, based on the level of parallelism required it would probably be more effective to write a Seti@home style app to run on all of our g4s and try to crack it that way.

Also, Amazon probably has something in its terms of service that prohibits using it for cracking encryption anyways.
[G4 Q&A, Help & Troubleshooting] ABotelho23:
It would be worth trying! There's almost 2000 people who have signed a petition asking for LG to unlock the bootloader. If we got say 500 G4's grinding through calculations at night while charging, how long would it take?
[G4 Q&A, Help & Troubleshooting] Jens1969:
You can't break the encryption, if it is implemented correctly. We would need a customized attack to reduce the search space. But even then, I highly doubt all our computing power will be sufficient to find the key in this century. But if we all own quantum computers, who knows? Might be faster in a decade.

Brute force won't work, we need some kind of trick here.
[G4 Q&A, Help & Troubleshooting] xrad:
As stated before, I'm no crypto expert but reading this is sufficient to understand, that brute force will not help. Unless "Life's Gruesome" opens the Booloader for everyone, we can be lucky if a jailbreak surfaces to at least obtain root.
[G4 Q&A, Help & Troubleshooting] 2nd Sky:
i sent g4 to repair.

it used cm13 so bl unlocked

after repair i had other device id and BL was locked...

IMEI is still same. so fits that to ur ideas? lg generates code with device id and imei

after that i have 2 unlock.bin´s with same imei but 2 different device id´s :D

**** THAT ****. I CANT GET UNLOCK.BIN

IT ALWAYS SAYS DEVICE-ID WRONG ON LGs PAGE

WHAT CAN I DO????
[G4 Q&A, Help & Troubleshooting] jjhaohao:
I'm doing some testing here, i sucessfully changed the LG H815 IMEI (Only for testing, don't start with "that's illegal blehbleh") but the device-id is still the same. So, maybe if we can find the partition where is stored the device-id (Assuming it's not generated with some key and is not stored) we can backup that partition with dd= on send_command mode, manipulate that device id and rewrite to mmc with send_command again. (Using a imei and device-id from an unlockable version) And then, use the unlock.bin generated for that imei and device-id for unlocking the bootloader.
[G4 Q&A, Help & Troubleshooting] ngoralph:
i dont get why changing imei cant be discussed here but there are apps posted on xda that changes imei -_- talking about changing imei = not allowed but posting an app for changiing imei = allowed? :confused::confused:
[G4 Q&A, Help & Troubleshooting] gborfitz:
Not the same thing. Apps change imei at system level. He's taking about change it deeper than that.

Enviado desde mi LG-H815 mediante Tapatalk
[G4 Q&A, Help & Troubleshooting] Knowbody42:
I wonder if you could temporarily change your IMEI and device ID, then unlock it with an unlock,bin, then change it back to the original IMEI + device ID

Or would that break the bootloader unlock?
[G4 Q&A, Help & Troubleshooting] Medizinmann:
Yes, it certainly would break the unlock - AFAIK it's checking on every boot.

Greetings

Medizinmann
[G4 Q&A, Help & Troubleshooting] nagalun:
What could 0x3a execute? Is a kernel dd'd to the sdcard or another location of the internal memory possible?
[G4 Q&A, Help & Troubleshooting] xrad:
See the instructions in this thread. Basically you push root installer files to the normal Android file system, and then in DL mode you use EXEC to mount /system and then root.
[G4 Q&A, Help & Troubleshooting] Loulou-13:
hi ! sorry for disturb you ....

at the first time i really want to thank so much all of you and congratulate for to try things.... :good: ;)

And i have a particular question : it's possible to create a modified/rooted MM on KDZ format and flash it with LGUP on phone with locked bootloader ???

the lp and mm have the same bootloader ?

i think that because we can root with lp with this damned "lock"
[G4 Q&A, Help & Troubleshooting] Shadicbypass:
I believe the phone would still do signature checking before it would be flashed and a modified .kdz would fail a signature check
[G4 Q&A, Help & Troubleshooting] Loulou-13:
thank for answer ;)

ok....and for a dev with knowledges ,it's possible to have a "good" kdz with new signature validation ?

or a LGUP "mod" for to bypass this vérification... :silly:

In theory ,i really think that it's the only way for to write on the kernel and system ....for to root a locked MM ...

i hope for a solution ...

And for to unlock thr bootloader, if i have understood your thread ,it's just an encryption problem ,impossible to hack ?

i'm specimist but good luck ;)
[G4 Q&A, Help & Troubleshooting] nagalun:
So...

We have root access and a minimal linux environment..?

Are you 100% sure it isn't possible to boot another kernel from there?

If the running kernel has module support:

Kexec

If not:

/dev/mem

I mean, yes, you would need a computer to start your phone, but its something, right?

You can most likely launch TWRP recovery without loading another kernel:

- Mount rootfs rw

- Copy fstab and recovery binary

- Kill process that has the screen occupied (Drawing "Firmware Update" image)

- Launch recovery

???

Profit

(Also, I have a H815P, I updated it to 20A with LGUP, if I downgrade, and the version letter doesn't match, will it brick?)

Example: Flash 10a, but before upgrading to 20a, it had 10c.
[G4 Q&A, Help & Troubleshooting] xrad:
The LAFD partition has all the rights you can think of. "We" have nothing, because the only way to make this environment useful was the EXEC command, which doesn't work anymore. I don't want to spoil your spirit and eagerness, but please do read all the posts in this thread and understand them. It's not so simple unfortunately.
[G4 Q&A, Help & Troubleshooting] nagalun:
You know full well that when someone finds something LG will have patched it in the next version and then it 'will not work'.

So I don't know what you are trying to tell me with "doesn't work anymore",

That doesn't mean it will not work for people using 10x.

Instead of trying so hard to unlock the bootloader, work around it.

The bootloader should not get involved at all when a kernel is already running.

I was just pointing out something that may have been missed.

I do not want to continue this conversation. Thank you.
[G4 Q&A, Help & Troubleshooting] esmenikmatixx:
like a safestrap built from the sendcommand.exe?
[G4 Q&A, Help & Troubleshooting] xrad:
Please calm down. I was just politely pointing out some misunderstanding on your part. In case you don't realize it, the Send_Command.exe technique which I explained in my initial post, is that very workaround for not being able to unlock the bootloader. And the whole post including this follow up discussion is about why it doesn't work on V20 anymore. Of course it still works on V10.
[G4 Q&A, Help & Troubleshooting] bg_man:
Can someone send me his unlock.bin. I would like to play with unlock and lock features of the bootloader.
[G4 Q&A, Help & Troubleshooting] alitavas:
there is a EverRoot option in the FlashFire app

if we flash MM from the app then enable EverRoot will it root MM?

i know this topic is about bootloader (im really sorry about it)
[G4 Q&A, Help & Troubleshooting] 2nd Sky:
MM needs also kernel modification if im right. so u need also root kernel and instead of that function u can also use supersu zip if im right ;)
[G4 Q&A, Help & Troubleshooting] alitavas:
I want to test it but can anybody help me to create Files.img

Sent from my LG-H818
[G4 Q&A, Help & Troubleshooting] Awesomeslayerg:
You can extract the files.img files from the kdz or tot for your phone.