yashsingh1/xdaforums huggingface dataset:
[Android Q&A, Help & Troubleshooting] bibikalka:
Hmm, I've played with QPST a bit using the latest version, and a few versions before this one :

http://www.androidbrick.com/download/unbrick-qualcomm-qpst-2-7-437-latest-qfil-qualcomm-flasher-2/

While I am able to connect to the proper COM port, the phone is not recognized :( Also, I don't have an MSL code yet ...

Also, while in download mode, I could not actually reboot the phone in any way ... Had to open it, and disconnect the battery :D

Would you be able to see if your phone is recognized in QPST ? It'd be of great help if we were able to download the current partitions using QPST ...
[Android Q&A, Help & Troubleshooting] mcduffy:
My phone is recognized in QPST - that's how I made the QPST NV Memory backup. However I'm not familiar with the software outside of following a couple of posted guides to try a few specific things. Can you explain how to download the current partitions using QPST?
[Android Q&A, Help & Troubleshooting] bibikalka:
That's good! Can you grab a few screenshots in QPST ? Specifically, the version, and how the phone is identified.

Did you have to get into the download mode? Or how did this work ?
[Android Q&A, Help & Troubleshooting] mcduffy:
I used QPST.2.7.430 initially, but I used the newer version 2.7.437 that you linked to for the screenshots and it worked just the same. Uninstall any older version of QPST before installing a newer version otherwise I found it can result in an incomplete installation

1. Install QPST and the LGMobileDriver on your PC.

2. On the phone open the dial pad and dial ##DIAG# (##3424#), enter your MSL number in the "Service Code" field and then tap "DIAG" and select the "Enable" option.

3. In the phone's "Settings" go to "Developer options" and under the NETWORKING sub-heading tap "Select USB Configuration" and select the "Charging only" option.

4. Connect the phone to PC by USB cable.

5. Open QPST Configuration by browsing to "C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTConfig.exe".

6. Click on the "Add New Port" button in the lower right corner of QPST Configuration.

7. In the Add New Port window uncheck "Show Serial and USB/QC Diagnostic ports only" on the left hand side. Of the two ports that appear select "COM*-USB/Unknown (LGE AndroidNet USB Serial Port, LGLS676f13ceec0)" and click the "OK" button.

8. Click "Start Clients" from drop down menu and choose "Software Download".

9. In Software Download window go to the "Backup" tab and choose your destination folder and name of your QCN backup file. Choose the second option "QPST NV Memory Files (.qcn)" in as "Save as type", NOT the first option as (.xqcn).

10. Enter your MSL number in the "SPC:" field and click on the "Start" button.
[Android Q&A, Help & Troubleshooting] -n0cturne-:
Aww.. So I need the MSL to get into diag mode, in order to get my MSL. Fun! Guess I'm going to have to activate it, but I'm cheap.. I take it ting or ringplus will just let me get a cheap month of service..?
[Android Q&A, Help & Troubleshooting] xebbmw:
You can start the activation with Boost and somewhere at the last step there is option to add funds to your account at a later date (the phone no assigned to you will be removed after a period in case no funds are added to your account). In the end the MSL code will be provided to you.
[Android Q&A, Help & Troubleshooting] bibikalka:
Is this gonna "burn" one's ability to register later with RingPlus ? Right now my phone is shown as fully RingPlus eligible. If I activate it with Boost, will it still work with RingPlus ?

I guess if MSL can lead to an unlock, that won't be an issue !

Great! Now you have a great chance to blaze the trail, and explore what QPST allows one to do :D Just find a guide on the web, and see if you could pull a few other things from the phone. That's definitely the most exciting development since the non-working DirtyCow exploit :(
[Android Q&A, Help & Troubleshooting] bibikalka:
I checked, RP still wants activation fee, so nothing is really fully free :(

By using the Dirty Cow root, I could switch phone into a different USB mode (as opposed to the standard "charge_only,adb"). I tried to do "setprop sys.usb.config diag,adb", but there is no diag mode :( Instead, I could get into a weird factory mode where I got the COM ports to show up, but the phone still was not recognized in QPST without doing it the other way via the MSL code.

getprop sys.usb.config
factory,adb

I tried to use cdmaDevTerm in this factory mode to read the MSL code, but cdmaDevTerm crashed when the correct COM port was chosen :(

I actually turned off the adb by mistake by doing "setprop sys.usb.config charge_only", then I had to remove the battery to restart the phone after the dirty cow root (ordinarily I restart by using "adb reboot" with this dirty cow root)! The phone booted, and the ADB switch was off. This seems to indicate that perhaps some other properties can be changed by using this dirty cow root.

[MENTION=7165185]mcduffy[/MENTION], when you have a chance, could you run this command "adb shell getprop sys.usb.config" while in DIAG mode ? I want to see what it says, perhaps, I could trigger this mode by using the dirty cow root. Also, can you also try cdmaDevTerm v.2.85 to check if you could read the MSL code (even though you already have it) ? I wonder if it always crashes, or not.
[Android Q&A, Help & Troubleshooting] xebbmw:
Mine returns something like this

getprop sys.usb.config
charge_only,adb

Only cdmaDevTerm V.2 returns the correct MSL. I tried also with Basic Flasher, EFS Pro and CDMATool but none returns the correct MSL.
[Android Q&A, Help & Troubleshooting] bibikalka:
Do you also have the right MSL code and you got that output in DIAG mode? And cdmaDevTerm works correctly ? There gotta be some other properties, do "adb shell getprop > prop.txt" right after you enter the MSL code but before "charge_only". Perhaps, the whole idea with setting charge_only as the last step is to simply restart adbd server. But DIAG menu sets some variables beforehand.
[Android Q&A, Help & Troubleshooting] mcduffy:
The first two times I tried cdmaDevTerm v.2.85 with the LG ls676 the info it returned for all the items I knew was correct but the SPC field was empty. I typed in the MSL and hit send and now with all subsequent tries it appears correctly. I also tried it with my Moto e XT1526. The first ten or so tries it gave completely differing numbers for all the fields including SPC, but never the correct ones. I un-ticked AUTO QC READ and it started returning the correct info for all except for the SPC (which changed for every try) even when I re-checked AUTO QC READ. cdmaDevTerm never crashed on me.

I think I've discovered aother way to get the MSL though. With NV-items reader_writer uncheck the first checkbox next to the SPC field (Send SPC at first reading) then click the Connect button and then hit the Read button on the right-hand side of the NV-items section (Backup NV items). It will only read to 51% and then prompt you to save the results as a text file. The MSL is stored at 00085 (0x0055) which will appear within the 51%. The MSL for the Moto e appears at the same address, by the way. The LOCK number that cdmaDevTerm returns is found just before at 00082 (0x0052) for both phones as well.

[EDIT: I forgot that the MSL is required to enable the diagnostic port which NV-items reader_writer needs access to, so this isn't a way to get your MSL.]

I did read that someone thought that the MSL was 0 before a phone is activated. it'll be interesting to know if that's true.

When I run the command "adb getprop sys.usb.config" it returns adb commands help. When I run "getprop sys.usb.config" in adb shell I get this:

C:\Program Files (x86)\Minimal ADB and Fastboot>adb shell

shell@k6b:/ $ getprop sys.usb.config

charge_only,adb

Did you notice that the USB Configuration immediately switches back to MTP once the USB cable is disconnected?
[Android Q&A, Help & Troubleshooting] xebbmw:
I am not sure it works without SPC code. I used the program and made some tests. First without providing MSL and the return at 00085 (0x0055) is SPC is required. Second time I provided MSL then the return at 00085 (0x0055) was OK followed by MSL code.

Once you have MSL code you may check different hidden menus as below (as per link)

5689#*676# – LG Hidden Service Menu

##RTN# – RTN Menu

##DIAG# – Enables DIAG Mode (Requires MSL)

##DATA# – Advanced DATA Menu

##DEBUG# – DEBUG Menu

##TEST# – DATA Test Menu (Requires MSL)

##LOG# – syslog Info

##SCRTN# – Erases Any Info That Has Been OTA Provisioned (Forces A Reboot And Reactivation)

##CLEAR# – Reset Network Settings

##SSDRTN# – Resets SSD
[Android Q&A, Help & Troubleshooting] bibikalka:
[MENTION=7165185]mcduffy[/MENTION], [MENTION=6387576]xebbmw[/MENTION]

I am able to use the Dirty Cow root to run the following command (had to Dirty Cow /system/bin/sh over /system/bin/ip in order to get a friendlier shell):

echo 1 > /sys/devices/platform/lg_diag_cmd/diag_enable

Then I did "setprop sys.usb.config usb_enable_diag,adb", and got the correct serial interface up. But there was not much more luck beyond that, the phone is still not recognized, just like before, same as "factory,adb" mode.
[Android Q&A, Help & Troubleshooting] xebbmw:
And this is a kind of temp root, right? Does the system keep the setting after reboot?

Did you install also Android drivers on your machine? Initially I installed only the regular USB drivers on my machine and I was playing with CDMA Tool and QPST programs. But still I was not able to see the LGE AndroidNet USB Serial Port even though the DIAG mode was enabled. It was only after I installed the LG Android drivers and also Universal Android drivers (although this was not neccessary anymore) that I was able to see such a port in QPST. I have an older laptop with Windows 7 that I use to do tests for LS676 and in my case the phone COM port under Ports is still a regular COM port, not LGE AndroidNet USB Serial Port as [MENTION=7165185]mcduffy[/MENTION] reported here.
[Android Q&A, Help & Troubleshooting] xebbmw:
It seems that other folks managed to modify files from /system partition. Just have a look here.

Could you give it a try on your phone? I did not start yet playing with Dirty Cow.
[Android Q&A, Help & Troubleshooting] Android_JT:
Happy 2017, everyone! :)
[Android Q&A, Help & Troubleshooting] bibikalka:
Cool! Nice tip! I'll check it out! I have a Moto E with Lollipop, will see how hackable it is using this trick.

Thanks to [MENTION=7165185]mcduffy[/MENTION], I now have my MSL code :D I've tested these instructions below, and they work :

I will try to dump the raw memory, we might be able to recover the partition table, /system partition, and other good stuff.
[Android Q&A, Help & Troubleshooting] Sands207:
That's awesome news???
[Android Q&A, Help & Troubleshooting] Android_JT:
Could someone explain what obtaining the MSL means for the ongoing goal of root for the lg tribute HD?
[Android Q&A, Help & Troubleshooting] rockinmusicgv:
It appears that the MSL code is required to enable DIAG mode. It also appears that files can be sent to and from the phone if it is in DIAG mode. If this is the case, it might be possible to achieve root by sending files to the phone. (I guess an entire AOSP distro?)
[Android Q&A, Help & Troubleshooting] mrsurge:
Nah.
[Android Q&A, Help & Troubleshooting] bakerd62:
It's like LG just wants to lock up the low end devices from dev work and leave there high end devices open for dev work......Seems like a desperate attempt to get there high end devices out in more hands.....Or I could be wrong
[Android Q&A, Help & Troubleshooting] zswielder:
It may have more to do with the carriers that they contract with. Phones like this one is being marketed to companies like boost, virgin mobile, etc. They are usually locked down to their networks and may also come with their bloat wares. Small companies probably don't want their customers to root or unlock their phones because they rely on every possibility to keep their profits. Just my guess. I could be totally wrong though lol
[Android Q&A, Help & Troubleshooting] akula1488:
hi, I don't want to sidetrack the rooting effort but since my R+ plan includes tethering, I am wondering is there any way to enable tethering or WiFi hotspot on this phone yet? or does this require full root access? thanks in advance.
[Android Q&A, Help & Troubleshooting] Sands207:
Progress is being made check this out http://xdaforums.com/showthread.php?t=3474426
[Android Q&A, Help & Troubleshooting] rockinmusicgv:
Thanks for posting!

Sadly, I can't seem to get any of the 'hidden' menus to work :(
[Android Q&A, Help & Troubleshooting] gldbnd:
Has anyone tried Wondershare MobileGo and use root option, just let me know thx in advance.
[Android Q&A, Help & Troubleshooting] -n0cturne-:
Most of those random no-name root programs don't actually do anything... Or at least I assume they do, as I've never seen one work. SRS Root, the weird russian one, etc -- at best they do nothing, at worst they are scamware. If anything, they may work on very outdated versions of android on cheaper processors -- but not marshmallow.
[Android Q&A, Help & Troubleshooting] gldbnd:
sooo no
[Android Q&A, Help & Troubleshooting] dannylolz4:
I tried mobilego and it's a no go..
[Android Q&A, Help & Troubleshooting] xebbmw:
I found this post here where it is mentioned how to enter fastboot mode:

I am not sure if someone tested this method for LS676.
[Android Q&A, Help & Troubleshooting] desilynn79:
thats for the stylo2.... may work for this phone but doubt it the stylo2 is an older phone that has root...
[Android Q&A, Help & Troubleshooting] kdm6389:
Anyone has rooted LS676 so far, i want to remove few files and add "Google Now Launcher" into /system/app
[Android Q&A, Help & Troubleshooting] mrsurge:
Grab a snickers. It's going to be a minute.
[Android Q&A, Help & Troubleshooting] -n0cturne-:
Have any of you looked into the dirty santa exploit..? Was first for the LG V20 but was adapted to the G5, uses dirty cow somehow to load a debug kernel (I think). Been meaning to take a look at it, but I haven't had much access to a computer lately..
[Android Q&A, Help & Troubleshooting] mrsurge:
I feel like flashing a bootloader intended for another device may be a bad idea.
[Android Q&A, Help & Troubleshooting] Tony the noob :D:
My 2 pennies here on this device. First i have no clue how to enter bootloader at first. If you can temp-root the device why not install SuperSU and let it write to system while temp-rooted for perma root? Second would be to unlock bootloader (?), compile TWRP/ CWM (?), and flash the SuperSu for root. But involves you putting your pc to work.
[Android Q&A, Help & Troubleshooting] gldbnd:
:eek:
[Android Q&A, Help & Troubleshooting] bakerd62:
Things are getting down to the T. Anything dealing with one click roots such as apps or computers are not reliable at the moment. The only thing I've been playing with is dirty cow. Not much success. I've been trying to get access to the bootloader or fastboot without bricking my device cuz there is no way how to restore my device if I do get bricked. I'm being careful with dirty cow. I thought I bricked my device when it got done with the commands after errors and my phone rebooted 10 times. I checked for root but nothing. I would check KingRoot once it updates but that's all I have in mind right now
[Android Q&A, Help & Troubleshooting] gldbnd:
ahhh

27 pages of post and threads about this topic and not one solution
[Android Q&A, Help & Troubleshooting] rockinmusicgv:
Is there a method other than "go here and buy a sim unlock"?
[Android Q&A, Help & Troubleshooting] Android_JT:
We shouldn't be discouraged. This thread only started a short time ago.

All good things require time.
[Android Q&A, Help & Troubleshooting] dannylolz4:
LG really put the screws to us here, it seems. Staying hopeful though...
[Android Q&A, Help & Troubleshooting] Sands207:
I'm still ready too. I chip away at new methods daily as I see them but I'm probably going to have to pay at some point. I'm almost past all of my compiling for the source code when the time comes but after getting checked for being nuts in here I'm quiet ?only want to help that's it ? back to the drawing board I'm talking to the guys on the v20 thread as they just got root and access to see if they can help, if i can do anything with that method I'll definitely chime in. It looks like the most promising method at least from here anyway...
[Android Q&A, Help & Troubleshooting] rockinmusicgv:
Did they get root via Dirty Cow?
[Android Q&A, Help & Troubleshooting] jilebi:
Yes, but their situation is different. Their path involved having access to an unlocked debug bootloader image.

However, their method has promise. I am trying to see if it can work on another LG phone (LG Phoenix 2 - K371) which is very similar phone to Tribute HD LS676. If it works for K371, then I am fairly certain it should be of help to folks on this thread. I am happy to share and help. We might want to join forces here...
[Android Q&A, Help & Troubleshooting] Sands207:
Thanks, the help is much appreciated. If i can help the process somehow let me know :good:
[Android Q&A, Help & Troubleshooting] rockinmusicgv:
Hopefully it can. I asked because a few other people tried Dirty Cow and so far haven't been able to do much with it. I'm hoping someone much smarter than me can figure this out.

Off topic, I know there was a root escalation attack discovered against certain distros of linux using a media stack; I don't recall exactly how it works, but would android be susceptible?
[Android Q&A, Help & Troubleshooting] jilebi:
There are two ways to proceed, using their approach. Both require good command over reading and interpreting sepolicy in SELinix. That is taking some time, since it has a steep learning curve. Anybody here who has worked on it?
[Android Q&A, Help & Troubleshooting] Sands207:
I have not. It's above my skill level, but I'm very interested in finding out more about it and I've heard about it recently here on other threads.
[Android Q&A, Help & Troubleshooting] bibikalka:
A quick update on dirty cow. A lot of progress has been made on Lollipop devices. But for Android M (including LS676) it's challenging since there seems to be no way yet to gain read access to /init file, and that's key if one wants to get something like a temporary root:

https://xdaforums.com/showpost.php?p=70362633&postcount=67
[Android Q&A, Help & Troubleshooting] jilebi:
I have made progress on k371 MM sepolicy to get a copy of init. However applying the galaxy s7 active dirty cow method to it will require disassembly of init code, which will take time. Do you have any ideas/suggestions on other methods once init is available?

Also, if somebody can post the /sepolicy file and /*contexts files (all are 444) from the ls676, I can try to see if I can find any holes in sepolicy to get init in the tribute HD too.
[Android Q&A, Help & Troubleshooting] Sands207:
I just uploaded those files here for you to take a look at https://drive.google.com/folderview?id=0Bz99NuhE3XwmZVhuTlVzNkxMbnc if you need more just lemme know ?
[Android Q&A, Help & Troubleshooting] bibikalka:
Which hole did you use with k371 ? The main issue with the dirty cow is that you need to be able to read the /init file in order to replace it, so were you able to read it from a running system, or did you just copy it from the update ROM ? If it's the latter, it's not so useful. The whole thread there is based on /init patching, but read access to it is key.
[Android Q&A, Help & Troubleshooting] jilebi:
I could read it on the running system. Unfortunately, I could not find an update ROM for k371. It would have helped a lot and saved quite some time if the update ROM was available somewhere for disassembly e.g. lg has locked down things so much on our phones, that it is difficult to even authoritively find the block device for laf partition, which we could easily have found from update ROM. We cannot assume that diskinfo is right, since there is no known documentation of how it finds the block devices of unmounted partitions in selinux locked down systems.

---------- Post added at 07:39 PM ---------- Previous post was at 07:38 PM ----------

Thanks! I will take a look as soon as I get a chance

---------- Post added at 07:51 PM ---------- Previous post was at 07:39 PM ----------

I went through the .c code in the post above, at a high level. It seems he is patching the init binary at specific hex offsets, implying he must have disassembled a specific init binary to find those offsets. For it to work on our devices, it would seem that the init binaries would have to be identical. Not sure why that would be so across devices and across android versions - his init patch works on lollipop while we are on MM. Unless, I am reading it wrong...
[Android Q&A, Help & Troubleshooting] jilebi:
A quick update. As I suspected, the binary offset edits for patching init in the thread above do not work for our devices on MM. I have done extensive debugging today. It shows that the binary pattern he is looking for is not present in our init. So we need some other means to patch init. I have reached out to [MENTION=2109949]kryz[/MENTION] for his help. Any other ideas for patching init?
[Android Q&A, Help & Troubleshooting] bibikalka:
It's possible it does not work for MM - no successes were reported so far. Which executable on MM allows you to read /init ? I think if you provide your init to [MENTION=2109949]kryz[/MENTION], he might be able to figure out the pattern. It'd probably help to have the source code for this init as well.
[Android Q&A, Help & Troubleshooting] jilebi:
I believe the K371 has a hole in sepolicy due to which the limited root shell from dirty cow can read init. I will await hearing back from [MENTION=2109949]kryz[/MENTION] on how to patch init. Is the source code for init in the kernal source tree? If so, do you know where?
[Android Q&A, Help & Troubleshooting] jilebi:
Update. [MENTION=2109949]kryz[/MENTION] has responded, confirming that his init patch will not work on our MM init. It will need to be disassembled separately.
[Android Q&A, Help & Troubleshooting] rockinmusicgv:
It looks like LG pushed all the open source stuff to their repo. Was this what you were compiling earlier, Sands?
[Android Q&A, Help & Troubleshooting] Android_JT:
Would you be able to explain what the init patch is?
[Android Q&A, Help & Troubleshooting] xebbmw:
You may find here the sources for MM firmware of LG K371.
[Android Q&A, Help & Troubleshooting] Sands207:
Yes it is the vanilla ROM http://opensource.lge.com/osSch/list?types=ALL&search=ls676 I finally figured out my build errors were caused by not using official Oracle 7 after setting up several build enviroments and only building LP and KK before this. I didn't realize that long story short. The guys over at the X power thread helped me set it up https://xdaforums.com/android/gener...wer-thread-t3474426/post70497373#post70497373 the right way last night and they got passed compiling woes too so I am hoping I can finally do it. I'm doing another repo sync in a few minutes to try again. The way they just got root was to compile this Vanilla ROM and I've thought this from the beginning. When it is finished going through the compile and build proccess convert the .zip it to .img and push it through adb as an update this act unlocks the bootloader oem unlock with the LG vanilla Roms just like the LG volt did and others too. Supersu can be pushed as an apk directly after for root using you guessed it ADB.. That's how they got root so that's what I'm trying maybe more magical thinking but I trust their guidance honestly since they just had almost exactly the same issues on almost exactly the same phone and procedures... I'll keep trying to help