yashsingh1/xdaforums huggingface dataset:
[General Topics] MotoJunkie01:
I am working on it. I ported TWRP from an LG device with the same board platform, same stock OS, and a near duplicate partition index. Like you guys I am now working on making TWRP overwrite stock recovery
[General Topics] Astr4y4L:
wondering if we can use this

(https://github.com/jcadduono/android_external_dirtycow)

its called recowvery i've played with it on other devices...

we'd have to change a few lins of code perhaps .....
[General Topics] MotoJunkie01:
I'll look at it. I've never used it before. Is it open source?
[General Topics] Astr4y4L:
Far as i can tell
[General Topics] MotoJunkie01:
Thanks for the link and the info [MENTION=8236433]Astr4y4L[/MENTION]. I like what I'm seeing. From all I've been able to gather, this device ships with an unlocked bootloader. Nonetheless, some unseen force seems to be guarding the confines of the /recovery partition as though it was Ft Knox. This dirty cow methodology seems to be geared for such devices as the Zone 3, forcing custom recovery to be written to the /recovery partition. I'm going attempt to create an updater-script which can be flashed from Flashfire, that uses this dirty cow strategy of flashing /recovery. I'll keep you updated.
[General Topics] MotoJunkie01:
The best way to post your screenshots (I'd personally love to see your themes/setup) is to log into xda-developers.com from your PC browser. There are options to post images, embedded links, & other advanced options not available via the mobile app.
[General Topics] MotoJunkie01:
I'm also going to fix the broken links in the OP for the downloads.
[General Topics] Astr4y4L:
Heres something neat

TIME SAVER....

After having updateing supersu and installing su to /system from within app

I had to do a factory reset . Afterwards i still had root and supersu all working had to reinstall busybox but xposed framework was even still intact.

So i recomend installing supersu to system asap.
[General Topics] MotoJunkie01:
I'm a step closer to getting custom recovery to overwrite stock recovery. It is simply going to require that the stock boot image be modified to an unsecured boot image. I've dumped the stock boot image and now using a Windows based tool to decompile it. Once unsecured mods are made, I'll recompile, reflash, then hopefully, custom recovery can be flashed to /recovery.
[General Topics] Astr4y4L:
Can anyone Please Link to The PP5 firmware.kdz

i want to make pp5 specific flash files.

---------- Post added at 11:11 PM ---------- Previous post was at 11:09 PM ----------

Awsome work

please link to your modified /boot when available

Thanks
[General Topics] MotoJunkie01:
I definitely will
[General Topics] MotoJunkie01:
[MENTION=8236433]Astr4y4L[/MENTION] I will look through my archives and see if I have VS425PP5.kdz firmware. I know I have PP6 but unsure about PP5.
[General Topics] Astr4y4L:
wonder how different pp5 is ??

I remember SomeOne Haveing Display Issues or something...

and i'm downloading pp6 now....

really would like to have pp5 specifically for pp5 phones just incase i need to extract drivers or something
[General Topics] MotoJunkie01:
I checked and PP2, PP6 & PP7 are the only kdz packages I have.
[General Topics] Astr4y4L:
Great you have it!

Please link pp5 soon as you have a chance

Much appriciated as i cant find it
[General Topics] MotoJunkie01:
No. I have 2, 6 & 7
[General Topics] Astr4y4L:
Oops....

Ok well perhaps it wont be an issue...

Downloading pp6 now...

Question while you are fixing the /boot would it be difficult to also enable init.d and usb-otg in kernel command-line ? i believe its all there in the ramdisk

Or Zlimage

?
[General Topics] MotoJunkie01:
I'll add init.d. If OTG support is possible I'll add it as well.
[General Topics] MotoJunkie01:
Insecured stock boot image for LG VS425PP (Zone 3). This image has a modified ramdisk with insecure boot support. It does not have init.d or any other mods. I will post an image with more mods at a later time.

https://drive.google.com/file/d/0B1Sfod4HWfk2NlRYZ1VST0ZjNXM/view?usp=drivesdk
[General Topics] Astr4y4L:
Awsome :)
[General Topics] MotoJunkie01:
I haven't tried to flash custom recovery with insecured boot yet. You wanna test [MENTION=8236433]Astr4y4L[/MENTION]?
[General Topics] Astr4y4L:
Yes.

Ive just flashed your /boot

Do you have a /recovery
[General Topics] MotoJunkie01:
Not that I would chance flashing. Try the CWM recovery referenced earlier in the thread. There's a link posted for it. I'm still compiling my TWRP. The insecure boot image will permit "adb shell" even if /system is unmountable. This gives us some more flexibility. I just hope a custom recovery will now flash to /recovery.
[General Topics] Astr4y4L:
Just tried useing same method as for / modem

But its not willing to be that simple.

Will look into it more tomarrow

My pc just died......
[General Topics] MotoJunkie01:
Another thought: we could use LG UP to flash the /boot & recovery partitions (and the working modem partitions) by extracting the kdz firmware package, replacing boot with insecured boot, replace recovery with custom recovery, and replace modem, fsg & ssd, etc, with the radio firmware from vs425pp7. After replacing the files, the package could be recompiled to kdz and flashed via LG UP. We would effectively have a firmware package with no boot loops, full telephony functionality, insecure boot support, and custom recovery. It's only a theory but worth a try. Also, if /laf was replaced with [empty file].bin, fastboot mode is possible, because we would basically be nuking the /laf partition.
[General Topics] Astr4y4L:
Ok. Sounds great. My PC with Python environment kraped last night.

Will take time to get the setup working again.

But I have most of what we would need in zips and rar over at amazon.

Bad news on top of bad news is we need to revisit the /boot because I had a feeling , and tried to use dd to write to the partitions to see if the partitions app was really changeling anything and from root terminal on device ,then fired

reboot recovery

And on boot got

SECURE BOOT ERROR 1008

So, I had to start all over Again but I'm getting quicker at rooting.

But yep secure boot......,

Don't remember that before. ...

The things that make you go hmmmmm.....
[General Topics] MotoJunkie01:
This device is strange to say the least. I have a member on another thread wanting to downgrade and root from PP5. I'm going to link him your workup package on the procedure. Then back to the drawing board for me.
[General Topics] Crashoverride1993:
Ok Moto junkie linked me here but how do I downgrade and on another thread I read something about some graphical glitches too is that solved or solvable yet?
[General Topics] Astr4y4L:
Ok. Go get lgup , get the stock vs425pp2.kdz

Use lgup to flash to version2

Bootloops are expected. Wait for it to finally boot.

Complete the first "activation" setup crap

Go to my site at

(http://astrayalslanding.dynu.net:88/Android_Development/)

Scroll to the bottom and click on (All android projects "click here" )

Download the zip file from the list there...

Named ( Zone3_root.zip )

Extract to desktop

Inside you will find a file called

(Read Me) it is a rich text document

Open that and follow the instructions precisely

All files needed are included in zip.

Also use the kingroot version I included,

Its the easiest to replace with supersu

Also there is a folder (mrw)

That's what replaces kingroot with supersu.

In mrw is a shell script.... Root.sh

I never get it to work right as a script. ..

Open it as a textile. Run each command from adb shell or

On device in terminal emulator.

After replacing kingroot use the partitionbackup.app to restore the images in PartitionsBackups folder to work their corresponding partitions...

Reboot.

Enjoy stable root.

As for graphical issues anything that you encounter is easier to fix/workaround when you have root without Bootloops.

If you need help ask on this thread and myself or someone will help,

[MENTION=2839601]Motojunki01 [/MENTION]

I really wish I could get my hands on pp5

But just thinking...

Once we make the firmware package you suggested,

What's to stop us from just adding root to pp7 /system whilst I have it seperated and just flashing that. I can mount pp7 /system.img in my linuxbox as rw and change anything we want....

Problem is its not to hard to extract from .kdz then you get some dll an installer and a .dz file, the dz we extract with python and get a bunch of image chunks.

Using python I assembled the chunks to an .image file,

Wrong format so I then use dd if=bla,bla.image of=bla,bla.img

And end up with system.img etc.

But we have to different method to re-chunk then we use python to reassemble chunks to .dz. Then add dll and installer etc and once again

Python compress that back to .kdz

My issue is I can successfully disassemble. Kdz

But haven't had success in reassembly...

Hmmmm.

Help me figure that out and we are there :)
[General Topics] Astr4y4L:
[MENTION=8200593]Crashoverride1993[/MENTION]

So, how did it go?
[General Topics] Astr4y4L:
Im not sure why I didn't think about this but...

"

Also, I tried installing a non-lokified custom boot image to the laf partition, it still fails with a secure booting error, so aboot checks the laf partition for a signing key :/ but yay, fastboot!"

This is from jackpotclavin on thread about nuking laf....

I bet aboot is our problem...
[General Topics] Crashoverride1993:
I was having trouble figuring out where to download the older version two stock firmware from.

The vs425pp2.kdz
[General Topics] MotoJunkie01:
Yeah /aboot has to be the culprit.
[General Topics] Astr4y4L:
I used google because when I got here, something bad had happened to Motojunki01 's googledrive links.

Ended up getting it from ( https://lg-firmwares.com/lg-vs425pp-firmwares/ )

And the files all have the letters ARBOO in them like this

Vs425PP2_02_ARBOO.kdz. the first one on that list and i recommend grab pp6 also as if something bad could happen.

That way you can get close to pp5. If you go back

Alternatively you could grab pp7. From LG Optimus. Verizon sites

To have a way out of brick state if u mess up
[General Topics] MotoJunkie01:
I'm planning on updating the links in the OP so thanks so much for finding a source for this firmware. I'll upload and repair the broken links.
[General Topics] Astr4y4L:
Do you have any knowledge of /aboot?
[General Topics] MotoJunkie01:
I have a decent understanding of its function. As application bootloader on an LG device, /aboot searches for a kernel upon boot up, which it finds in /laf, then proceeds with boot.img. This is exactly why fastboot mode is typically inaccessible. If you nuke /laf, /aboot finds no kernel and thus fastboot mode is force booted.

I also know that /aboot is an extremely easy partition with which to hard brick a device beyond repairability. We must use great caution in this area of the device. I'm trying to work a bypass out with regard to /laf and /aboot.
[General Topics] Astr4y4L:
I'm not sure if any of this applies here but concerning aboot check this out

( http://newandroidbook.com/Articles/aboot.html )

I think its saying if I replace or remove parts of aboot.

If certain file sizes match up it equals the sign key

And that's how and where we break the secure boot chain of trust...

I'm kinda busy and my development machines are out dince the server died.

But if any one wants to try I can link up stock aboot for reverse engineering purposes
[General Topics] MotoJunkie01:
You and I have the exact same analysis it looks like. We can try this as well. The /aboot secure boot error is being returned, I think, because /aboot identifies that the stock boot image has been modified to insecure. An alternative way around this may be to set boot as insecure from the OS (a root file explorer can set default.prop ro.boot.secure=0). Then once recovery is flashed, return ro.boot.secure from 0 to 1. Then reboot. In theory the secure boot error should not occur. I'm out of town for work again and can't try this theory.
[General Topics] Astr4y4L:
I will when I get set up for lgup and all again

Might take a few days...

I really want to take aboot apart to see what can change
[General Topics] Astr4y4L:
[MENTION=293243]MotoJunki01[/MENTION]

Have a look at this....

L)ittle (K)ernel based Android bootloader

First of all thanks to Travis Geiselbrecht, Brian Swetland and Dima Zavin for the initial work on (L)ittle (K)ernel project and open-sourcing the work on kernel.org <http://kernel.org>.

Our current version of Android apps processor bootloader is based on this LK work and the Android team at Qualcomm Innovation Center, Inc (QuIC) has added and opensourced features to the project.

We currently support variety of Qualcomm chipsets, including MSM7X25, MSM7X27, MSM7X30 and QSD8X50. The bootloader does the basic task of hardware initialization, reading the Linux kernel & ramdisk from nand device and loading it up to RAM, setting up initial registers and command line arguments for Linux kernel and jumps to the kernel.

In context of support for Qualcomm chipsets and Android, the bootloader currently supports:

* Variety of nand devices for bootup

* USB driver to enable upgrading images over usb during development

* Keypad driver to enable developers enter 'fastboot' mode for image upgrades

* Display driver for debugging and splash screen

* Enable Android recovery image and image upgrades

Here is a list of FAQs that we get from OEMs to customize the bootloader for their projects:

Anyways. It seems the whole bootloader is opensourced or at least aboot is.

See whole story

(https://www.codeaurora.org/blogs/little-kernel-based-android-bootloader)

---------- Post added at 08:36 PM ---------- Previous post was at 08:33 PM ----------

Maby we can put together our own...

From source.

Byebye secureboot

---------- Post added at 08:44 PM ---------- Previous post was at 08:36 PM ----------

Ooooooo ¡!!!!!!!!!!

Found it :)

("Q2) How do I disable 'fastboot' for my commercial device?

A2) Personally, I would like to see commercial devices leave 'fastboot' enabled. It goes in the spirit of Android Open Source Project where end users and developers have access to the source code to allow them to modify it and upgrade their device over usb using 'fastboot'. However, if OEMs or network providers want to lock down 'fastboot' it can be done by disabling the keypad and usb driver in bootloader. This can be customized in the following files:

lk/app/aboot/fastboot.c

lk/app/aboot/aboot.c

")

So it can all be fixed if we compile it our selves.

Oem sabotage of fastboot is a shameful practice.
[General Topics] MotoJunkie01:
This sounds right on point as to what we are trying to accomplish. I'll definitely be looking at this closely when I get home tonight. Great find [MENTION=8236433]Astr4y4L[/MENTION]. Things are looking better by the day.
[General Topics] Astr4y4L:
And I been reading aboot this too regarding custom kernels... I think with changes it shoulld work too

(https://xdaforums.com/showthread.php?t=1538580)

---------- Post added at 10:22 PM ---------- Previous post was at 10:00 PM ----------

We need to reverse engineer aboot.c and fastboot.c to removethe patch that blocks the drivers from working.

Then....

Then we own the device

---------- Post added at 10:47 PM ---------- Previous post was at 10:22 PM ----------

I'm having a pc hardware crisis ....

Wish I had another amazon ec2 instance to work from....

Edit:

My wife gifted me with another aws... awwww. :)

Now waiting for the services to get setup.

I'm going to do nothing but development for this there. So it'll make a great repository for our work....

Also thinking about our code changes could be synchronized by github...

Anyone want to help set that up?
[General Topics] Astr4y4L:
ok

we have a github now...

(https://github.com/astrayal/ZONE_3_root/)
[General Topics] MotoJunkie01:
Wow. Impressive developments for our Zone 3s. Guys please be sure to thank [MENTION=8236433]Astr4y4L[/MENTION] for his hard work on this device. We are finally making some headway.
[General Topics] MotoJunkie01:
I'm am uploading several software versions of stock 5.1.1 for the vs425pp (pp2, pp4, pp6, pp7, pp8), and will update the broken links in downloads section later this evening. I'll also renew the link for the Verizon LG Software Upgrade Utility.
[General Topics] Astr4y4L:
Kool.... still waiting for amazon to get thair stuff together.

Then I'm going to devote my new aws instance solely to reverse engineering /aboot (lk)
[General Topics] Astr4y4L:
Ya know it would be awesome to get something like Multi-Rom working on the vs425pp.

I was playing with the notion of trying to port Ubuntu-Touch
[General Topics] MotoJunkie01:
Thread has been revised. All broken links fixed in the OP.
[General Topics] Astr4y4L:
Awesome my new supercharged amazon compiler is ready....

now I need to find Sources for our particular flavor of /aboot

ive been reading about this "Qcom Board Support Package (for msm8909)"

"CAF Open Source (for msm8909)" and quote "We can compile our own bootloader with this. LITTLE KERNEL."

form thread here{ https://xdaforums.com/desire-526/or...sm8909-service-rom-source-qpst-t3544178/page3 }

now obviously this won't be the same exact procedure for our device but...

we do have msm8909 cpu and so ARCH and Platform related things should remain similar .

if anyone has any source for any of these things please point me to it and i'll begin .

I have only about 20GB of space on the Aws server so I don't want to use compleate android ndk source. etc.

any suggestions,
[General Topics] MotoJunkie01:
I have a feeling we are near to having fastboot & custom recovery. Great work [MENTION=8236433]Astr4y4L[/MENTION]
[General Topics] Astr4y4L:
some infobase to start from obtained through python script ./parse-aboot.py

aboot image aboot.img, len=2097152

aboot header:

----------------------------------------

magic: 0x464c457f

version: 0x00010101

NULL: 0x00000000

ImgBase: 0x00000000

ImgSize: 0x00280002 (2621442)

CodeSize: 0x00000001 (1)

ImgBaseCodeSize: 0x8f600000

SigSize: 0x00000034 (52)

CodeSigOffset: 0x00000000

Certs size: 0x05000002 (83886082)

Unrecognized format, magic=0x464c457f

and so thats where im at and what i'll be working on.

i'm kind of busy with Real-Life so won't have as much time but good news is i've got a setup so that i can log-in from my phone and run anything on the server so i can work here and there when-ever i have time...

could really use some pointers / tips on where to go from here.

i think decompile /aboot and study it from our device as source then when i figure out where and how to get the source for Little-Kernel we compile our own and inject the modules and drivers etc from our decompiled /aboot to make our new-aboot work on our particular hardware...

believe it or not i've never attempted this before so i'm open for suggestions.

thanks

Astr4y4L
[General Topics] Astr4y4L:
[MENTION=7383447]MotoJunkie01[/MENTION]

here's what I've put together so far

( http://18.220.133.114/android/ )

I amnot sure what program to de-compile with. I'm trying to set up (readare2) prob ably misspelled that. In a hurry but. If you or anyone wants to look at this and post advise or idea's ...

Inside lk is the whole open source part...

We need to take apart aboot to get the hardware specific partsand I believe by injecting that into lk's folder structure we can issue make and have our very own .

With out the lockdown krap.
[General Topics] SquaredDev:
Hi guys. I am suprised to see so much information on this device!

My device came with the 5, but I tried to flash it to version 2 and 4... currently on version 6.

My issue: When I use the LGUP to install version 2 or 4, I get the white screen and black lines.. it seems semi responsive because it somehow boots into "blind person mode" and wants me to drag my finger across the screen. I really need a temproot solution just long enough to install an app to /system. But cannot seem to find a root for 6/7/8.. I have tried all those versions.. but when I downgrade to 2 or 4, it's like a display driver issue or something. Is there something I can do?
[General Topics] MotoJunkie01:
I'm very impressed with your work, and your dedication to this device. I will give you due credit in the OP.
[General Topics] Astr4y4L:
Version 6 is running on your device no problems?

I would recomend flashing a .tot with the pp2 system image and all other partitions images from pp6.
[General Topics] SquaredDev:
Good deal, thanks for responding. Soon as i figure out what a .tot is and how to add it to the pp6 kdz i will try it out. If this works, I will be donating 30 bux to ya soon as i get paid :D
[General Topics] Astr4y4L:
a .tot is the same thing as the .kdz

it is a package of firmware images packed into an archive...

a zip file is a good comparison its just a special archive format if you google and look around on xda there are various examples of how to prepare a .tot for lg flash tool... thats where you'd start then you'd have to extract the firmware out of the stock .kdz versions pp6 and pp2 to get your mix and match then .tot it all together and zap it through lgup
[General Topics] SquaredDev:
Alrighty, thanks for sending me in the right direction :D I have since tried LGExtract and a few others i have found on the thread but can't seem to get them to read. I keep getting "not a valid kdz or tot file". I downloaded them all from the OP. But I shall keep at it. I gotta try to finish this before tomorrow night because I leave out on thursday.
[General Topics] SquaredDev:
[MENTION=8236433]Astr4y4L[/MENTION] I really appreciate the help! But I think I am just gonna tap out. I can't figure out how to add the recovery.img to the kdz for version 6. I was able to get the images from version 2 but not version 6. Thanks again for pointing me in the right direction, I just think this is beyond my skill level right now.

And [MENTION=7383447]MotoJunkie01[/MENTION] Thanks to you as well for this awesome thread. You guys are awesome!
[General Topics] Astr4y4L:
[MENTION=7383447]MotoJunkie01[/MENTION]

REQUESTING GENERAL ADVISORY .....

FOR NOW NOT COMPATIBLE WITH VS425PP5

HARDWARE.....

untill I have time to try to compile a pp5 specific package for root
[General Topics] MotoJunkie01:
Ok. Thank you for the update and warning. Do you think I should update the OP with this info?
[General Topics] Astr4y4L:
I would recommend it. The unbricking works for pp5 since we can flash it to pp7/pp8. But rooting pp5 not recommended untill we put together a .tot or .kdz

What bums is I don't have a pp5 test device...

Later when I get time I'm going to look at lgup flashable .tot files. And I wonder if I can mount pp7 /system.img and inject root and busybox etc. Then flash that ...

If I can figure out the pp7 system-root injection and dd rooted pp7 system over to my device if it all works...

We could then put that into a .tot for lgup and have universal root...

Should I work towards the pp5 stability problems or should I move on with /aboot ?

Also on your google drive withthe .kdz files....

Please rename them pp2.kdz ,pp4.kdz, pp7.kdz

Respectively as its not going to matter to lgup. And will be much less confusing when browsing from mobile decices.

It would also be nice to do a role-call to see who has used what on what device and does it work....

Who else has successfully rooted thair device and what model did they start with....
[General Topics] MotoJunkie01:
I'll make the necessary revisions to the thread today, as well as your recommendations on the kdz filename changes to simplify searches.
[General Topics] MotoJunkie01:
[MENTION=8236433]Astr4y4L[/MENTION], I would like to add the link to your root package in the OP. Of course, I'll ask your permission before doing so. Let me know if that's ok. I'm revising the thread some now.

I would like to take the time and summarize/better organize the downgrading procedure for this device. The instructions are here but sort of scattered. Your root package is very clear and concise. However, it may benefit us to outline the downgrading method as well.