yashsingh1/xdaforums huggingface dataset:
[General Topics] Astr4y4L:
exactly why I'd like to replace ours with the older one from G2

right now if we nuke laf we get that stupid-crippled fastboot.

however I have a old tester that came with broken-glass and PP1 on it...

and before turning it into a pp7 and then a k4

I did dump the whole rom...

I could send you the aboot from that and we can see if that one's crippled...

it's older than your c version...

but you'll have to write it to the device with partitions backup tool by [MENTION=3562083]wanam[/MENTION] available from googleplay..

---------- Post added at 06:07 PM ---------- Previous post was at 06:05 PM ----------

well as long as the phone will still boot up you could restore the image using the exact reverse of the command you use to back it up...
[General Topics] Chekm8Qc:
Argh .. this is scary.

So aboot is not like boot.img right.. It won't screw up boot you sure ?
[General Topics] Astr4y4L:
I know right...

I started with one zone3 and ended up totally killing at the least 3

had 5 bricks at one point but kept going and buying another one at $20 US a pop

and trying [stuff] again and again untill i figured out what we've got thus far...
[General Topics] Chekm8Qc:
yeah what you have accomplished is amazing work hehe. Phones over here are expensive though ..even my crappy k4.
[General Topics] Astr4y4L:
well while i was sitting here i couldnt resist flashing it over on the device and it booted which was no surprise it's just the earlier version of same firmware.. PP1 -- i mean

I'm not brave enough to try the G2 aboot yet it's from a different device and if it don't work i'd be screwed on development till i get a new device...

but later ill definately nuke laf on this one to see if that gave real fastboot...
[General Topics] Chekm8Qc:
so flashing that aboot might simply brick my device ? Will I be able to go to DL mode at least?
[General Topics] Astr4y4L:
theres the possibility when flashing other-than-stock or -wrong- firmware to royally Brick the device...

thats why i wont try with the one from g2

but the PP1 versions of everything are compatible ...

just tested on a modded Frankin_Fone

for all purposes it's the same as your K4 so it should be no prob...

mine don't want to give me adb for what-ever reason... i broke it.

but i'll check later to see if that changed the way stuff works at all
[General Topics] Chekm8Qc:
ok can u send me the link to the pp1 aboot ? Just in case I suddenly feel like flashing it lol. I am very interested but still kinda unsure :)
[General Topics] Astr4y4L:
yep i'll PM you the link to the folder containing the entire boot chain...

---------- Post added at 07:27 PM ---------- Previous post was at 07:22 PM ----------

@Chekm8Qc

check PM's
[General Topics] wdthompson:
Er,, I have actually read the whole thread,, its so long

But I don't remember this

>.. Oh about page 20 -something of this thread and just read all the way through to present you will see that >we've tried modifying the aboot before but since it's not going to match the original then the Sum will be >different resulting in No-Boot or Secure-Boot-Error-1004 or Secure-Boot-Error-1008 ...

I should have realized that it is so locked down by all your toils
[General Topics] Astr4y4L:
OH YEA parts of that info may actally have been passed in PM...

but yes we need someone to start a New thread based on whats current

because its become very easy to get lost on this thread... LOL

but if we can just get the stupid aboot fixed i think we'd be all good.

aboot is what checks security for boot partition that we are used to tampering with in other roms...

so aboot is where we must break the chain of trust if we want to replace the files in the ram disk of /boot partition...

seems

your experienced on linux so if you want to take a stab at it you will find testers around here... but I would personally try it on a device I own first ...

that way no one kills a phone and gets all Butt-Hurt about it...
[General Topics] wdthompson:
Like I said in the post, I get the phone next week, its in the mail, can't do anything til then

I seldom use win, have to check out your toolchain

Since the phone is about 3x the price you can get them for (factoring exchange), I will be a bit cautious

Why are they so cheap in US?

this is actually better than Allwinner (tablets), fortunatly they are unbrickable,,

there is a good reason there are no button presses to get to recovery,

3 out of 4, just going to recovery resulted in bootloop, on a fresh install,

and the 4th, only the power button did anything, all you could do was reboot

Really crappy software,, and when I did a dump of recovery, there was the ANDROID! string,

3/4 of the way thru, !!! followed by lg and lge strings !!!! So it could be worse.
[General Topics] MotoJunkie01:
Yeah I agree with you [MENTION=8236433]Astr4y4L[/MENTION] -- a new thread would freshen things up. And, I think a new thread would highlight your recent work as well as a great place for links to your modded LG UP and other recent work.

By the way I've recommended an XDA Moderator review your work and contributions, and consider you for a Recognized Contributor. You should get a PM regarding that decision within a few days.
[General Topics] Astr4y4L:
I would love to see it {both the PM and the new thread} and if you would like to start the thread I'll put a static unchanging link to my site there as well as links to everything that I deem Freebie's as far as my R&D files...

Thanks so much Brother for your Continued Support !

I Really want to get every thing laid out in a clean orderly fashion.

I guess I could write a thread on it all after all I can build working websites...

but, I just don't have the time at this moment to do it all by my self.

It would do well to be laid out in the fashion that things were explained nicely for neewbs

and each tool or link to a file explained separately...

of course if I were to take the time to do that I'd just add more pages to my site to separate and explain things from there that way I control the content and all rights to it...

but if you do it here I could easily separate things and organize the Back-end of my server

to accommodate your post structure and links here on XDA. then we can have the free -well documented general post with a link to that folder.. followed by a link to my site for reference to My Donate-only section and a list of the tools and files and process involved.

If you'd Help me with Xda end I'll handle everything on my end and get some better laid out instructions for each different mod we have and how to use them..

and then I can spend more time Breaking New [TEST] devices and less time explaining things...

Really need a dump of that Krazy K3 Old-school firmware.

I guess you still are stuck on that guy eah?

I have a zone3/k4 [Fr4nkin-fone] in the weird state of no usb connection

unless I go to DL -mode then it connects...

it's some kinda Bug in LG roms I think...

or maby not a bug but a self-imposed condition

resulting from tearing out the little android-Guy's gutz and packing different stuff back in there...

But needless to say if you can find an old k3 we can dump him to get that rootable firmware...

Well Brother, I guess I'm calling it a night.

Add me to whatever group is enabled to PM you so I don't Have to blab openly in public about our upcoming top-secret Projects...

Laterz

Astr4y4L
[General Topics] Chekm8Qc:
Just tested my dumped rooted system image with LGUP and it works.. good to know. The phone didn't boot after activating lucky patcher in xposed lol oops :)
[General Topics] wdthompson:
http://opensource.lge.com/osSch/list?types=ALL&search=vs425pp

and of course

http://opensource.lge.com/osSch/list?types=ALL&search=k121

have not yet found aboot or sbl in this,, maybe it is in the android src
[General Topics] Chekm8Qc:
That's interesting .. Would be great if you found that aboot for our exact model :) Since its version 10a maybe the fastboot won't be messed with.. hopefully.
[General Topics] MotoJunkie01:
Yes, your work -- and everything we've amassed on the Zone 3 -- would look great on a clean, neatly laid out and organized thread. This old thread has been ok for sort of a catch-all of different topics for the Zone 3 -- firmware, general info, unbricking, and of course your comprehensive guides, root packages and software you've developed.

Tell you what, I'll draft and post the thread right now while I'm free. What do you want the title of the thread to be? Give me a general idea of the title and opening and I'll lay it out.

And, it would be great if we could maybe co-author the thread. I can place all links you want posted in the OP - just provide me links and descriptions via PM.

Thanks [MENTION=8236433]Astr4y4L[/MENTION].
[General Topics] Astr4y4L:
Awesome !!!

Well I tried to Pm you but still as right now the stupid thing doesn't let me...

Says Bla bla bla Motojunkie01 has chosen not to recieve Private messages bla bla bla...

so I can't PM you

AAAAHHHH !!!!

ok but yea, anyways we can still call it "Frankin_Mod_Root Project"

with a description " Universal zone3 root method + k4-121"

plus we need to mention that we've created (Frankin_Fone) the zone3's flashed to K4 and partially GSM-enabled)

co-authored by us both sounds great !

I'll go clean things up at the server-backend NOW to organize the links easier

"wish I caught you earlier... been working on my mothers church website all morning ( http://rscc.dynu.net/ ) and didn't see the notifications..."

So what do I need to Do to contact you, It wont let me PM you?

---------- Post added at 01:54 PM ---------- Previous post was at 01:48 PM ----------

it's not open sourced completely ...

the aboot is based on Littlekernel project (google-it)

but I've got it dumped from a device and also extracted from our stock .kdz firmwares... just haven't been able to modify it in any way because of the security checks...

freekin sux

---------- Post added at 02:29 PM ---------- Previous post was at 01:54 PM ----------

i've got links ,discriptions and such ready . cleaned up the server a bit...

I'll try to pm you and see if that works yet...

---------- Post added at 02:33 PM ---------- Previous post was at 02:29 PM ----------

@Motojunkie01

Still can't PM you... WTF is wrong with xda? Grrrr.

email me so we can bypass xda for secure communications...

EDIT --->EMAIL REMOVED

Astr4y4L

Team_Astr4y4L
[General Topics] MotoJunkie01:
Sorry about the PM thing my friend. I need to sign into XDA on my browser and fix the settings in my User CP for messaging. I've got it set to only allow PMs from contacts on XDA and I thought I had added you as a contact/friend. I'll get that fixed asap
[General Topics] Astr4y4L:
Well I'm going to try some things I'm now downloading the many many gigs of source for cm 12.1

and I know that pure Cyanogenmod will not boot here unless i can get LG to sign the image... huh, imagine that.

but what I Am going to try is to open one of these signed images in linux and erase/replace things with pieces of my freshly built cm12.1 lollipop image...

Apps init scripts and framework stuff will all catch attention in this Mod...

My hope is that by ripping the android guys guts out and stuffing him full of Cyanogen_Mod Team_Astr4y4L goodness The result will be an ext4 system.img signed by LG containing MY system instead of there's.

now this will not be like the usual CM build as lots of CM's features will not be available because of the way LG has Implemented the init in a locked way and cant change it because it loads from /boot partition and I can't mount /Boot and change it on the fly like the other partition....

YET.....

but that too is on the table once the R&D gets back to it

Updated Our Site to prepare for the New thread that [MENTION=7383447]MotoJunkie01[/MENTION] and myself are going to co Author.

there's going to be a direct link in the New thread that will link to a folder where I'm putting some good Freebies {tools, apps, firmwares, etc}

here's the link to that page and it will also be posted in the new thread when we move...

http://www.astrayalslanding.dynu.net/All_My_Tools/

and [MENTION=7383447]MotoJunkie01[/MENTION] I suggest we use the above link for that as I've hardcoded everything in Html and that way it's seperate incase the content management frontend for the site buggz out or something we wont loose this linked page and wont have to update the OP in the new thread...
[General Topics] wdthompson:
I think that some of the little kernel src is in android/vendor/lge/factory/minios ,,

in the adroid tgz from http://opensource.lge.com/osSch/list?types=ALL&search=vs425pp or K121

But that is only part of it, only the lg specific(modified?) parts, and not the kernel or initrd

There are only 2 references in that whole thing to aboot (grep -R), in the kernel tgz, to MIPS

---------- Post added at 04:56 AM ---------- Previous post was at 04:42 AM ----------

But, to be clear, aboot is not an android boot image,,

file aboot_151552.bin

aboot_151552.bin: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, stripped

aboot and its bak are identical as are sb1 and its bak... sb1 is also ELF 32 bit ...etc
[General Topics] Astr4y4L:
Regarding little kernel

that's absolutely an awesome find. It verywell may be the Piece we didn't have.

Take a look at this article it is a good read on aboot and little kernel. And has link to lk source

http://newandroidbook.com/Articles/aboot.html

---------- Post added at 11:02 PM ---------- Previous post was at 10:58 PM ----------

Your right its not. Its a binary file which is signed by lg.

Give the article I referenced a read please.

I believe it will help you understand

And and also I believe its got the info you'll need for aboot
[General Topics] Astr4y4L:
@MotoJunkie01

Hey brother I may have found the problem with the Voice calls on the GSM/DSU thing...

in the Hidden menu I found a place to configure LTE also IMS Provisioning [the core network IP Multimedia SubSystem (IMS) ], P-CSCF

and Network-Mode {IE: LTE-only}

so after researching what all these alphabet-soup settings are I've found that these things control how the device connects and so now I need to know some info about what settings to apply in these menu's

If I can find the proper value's the device will then regester on the LTE and make telephone calls ,[ we already have both data and SMS ] so this is it !!! the missing piece of the puzzle !!!

Brother I'm Stoked ;) @MotoJunkie01 I am hoping that you can use your resources to assist me in finding the proper values to plug in to it and then we can unlock the networks fully { voice,SMS, and Data }

PLEASE help me figure this out... you Know WAY more about radio frequency stuff than I and you have access to info that I can't access {with-out getting into trouble}

Help us O B 1 your the only HOPE!!!
[General Topics] MotoJunkie01:
Ok my friend....I finally figured out the PM problem and got it fixed. You should be able to send me a PM now. I'm very sorry it gave you an issue. My settings in the User CP are set a bit unorthodox but I believe it's now fixed.
[General Topics] MotoJunkie01:
PS, I'm willing to bet you're on the correct path with the GSM issue you're exploring. And, this is my next project if I can get the extra time to work on it.

https://xdaforums.com/android/general/guide-zte-blade-vantage-z839-specs-t3696635
[General Topics] MotoJunkie01:
Great. You've stumbled upon the service programming menu, which as you have pointed out, will allow us to input the alpha-numeric values to enable GSM support and possible VoLTE. I sent you a PM. Check that out and you'll see my present status.
[General Topics] Astr4y4L:
Sweet!!!

I See what you mean .. Obviously I'd like to get this last piece of it straightened out.

I KNEW if I could Get into it there would be something good and signs pointed to it controlling the databases for the settings we need to make work...

And I Knew Once I got in to it too see and found these Settings that YOU Sir would be The Guy who would be able to help with this ;)

---------- Post added at 02:32 PM ---------- Previous post was at 01:37 PM ----------

VoLTE UE Attachment and IMS Registration

A VoLTE UE, under LTE coverage, shall automatically perform an LTE Attach (What I've had success with{ie messaging and lte data} ) followed by an IMS registration for VoLTE, (THE SETTINGS I FINALLY CRACKED OPEN)if the network supports VoLTE. This ensures that the VoLTE UE shall be available for VoLTE services (i.e. incoming calls, outgoing calls and supplementary services), similar to the voice experience in today's CS network ...

So that's it folks We have confirmation that I have found the Last piece of the puzzle concerning GSM-Unlocking these things... Am I making calls yet ?

Well no... I have to tell the device to register on at&t's network first...

So I will be working closely with a few select friends to compare and test different possible values in the settings and by trying the values from other devices that access At&t's Network first we narrow down the possibilities

And I have A $500 USD wager riding on my success or falure in this thing so I'm not giving up..

If nothing else I'll just keep on trying different values untill something makes sense..

Kinda Hope that that other guy figure's out /aboot.

if that happened and we figure out this then Zone3 and for that matter e1q hardware platform will be in for some Crazy-Fun advancements !!!
[General Topics] Astr4y4L:
Screen-shots

Ok Guys Here's some random screen-shots of what I'm working on...
[General Topics] Astr4y4L:
it's headed toward full gsm unlock very quickly...
[General Topics] Astr4y4L:
HAH here's another useful screen shot...
[General Topics] Astr4y4L:
---------------- > Team_Astr4y4L

Stickin it too em' again ... LOL

we're about to try to get the required info from mom's cricket phone and it's an lg.....

completely diff model but should have the info in it somewhere...
[General Topics] wdthompson:
>Kinda Hope that that other guy figure's out /aboot.

I was poking at it a hour this morning,, I am not that good

I can tell that is a different aboot header, for KK and our header is different

Can find lk starts at 0x8000, there are 2 refs to that address, 99-9a and b0-b1,,

and likely the cert is not 0x100 (long) but 0x1000,, 59-5a

I am not sure if your zone3 aboot is the same as K121,, so,

md5sum aboot1st512.md5

adc7661852de46ad8f438865704d6530 aboot1st512.md5 ,, (dd,,count=1)

and

02f09a607b50f8e556211c17c43ae0d5 aboot_151552.bin

and the hardware may not be exactly the same,, k121 has 1G mem, zone3 has more I think

(and so the dt(device tree) is likely a bit different, that is in there too , appended I think, then cert)

ro.product.device=e1q

ro.product.board=msm8909 ,,(build prop)

etc/init.lge.zramswap.sh lists 4 or 5 different boards
[General Topics] wdthompson:
[MENTION=8236433]Astr4y4L[/MENTION]

Thanks for link,, my box doesn't have so much mem to run vbox easily,

I managed to get radare compiled, but not cutter (the gui), it wants newest qt5

I am not at all skilled in disassembly, but I will poke at it for a few weeks

I gave the md5's and board info so you could see how similar 3 and k4 are,

I doubt that they are identical (aboot,,GPT) (K4 GPT appended)

7c-f is where aboot ends up in mem, the 2nd half (8f600000)

K4 GPT

Number Start (sector) End (sector) Size Code Name

1 16384 147455 64.0 MiB 0700 modem

2 147456 148479 512.0 KiB FFFF sbl1

3 148480 150527 1024.0 KiB FFFF tz

4 150528 151551 512.0 KiB FFFF rpm

5 151552 155647 2.0 MiB FFFF aboot

6 155648 156671 512.0 KiB FFFF sbl1bak

7 156672 158719 1024.0 KiB FFFF tzbak

8 158720 159743 512.0 KiB FFFF rpmbak

9 159744 163839 2.0 MiB FFFF abootbak

10 163840 166911 1.5 MiB FFFF modemst1

11 166912 169983 1.5 MiB FFFF modemst2

12 169984 171007 512.0 KiB FFFF ssd

13 171008 172031 512.0 KiB FFFF DDR

14 172032 175103 1.5 MiB FFFF fsg

15 175104 176127 512.0 KiB FFFF fsc

16 176128 177151 512.0 KiB FFFF sec

17 177152 178175 512.0 KiB FFFF keystore

18 178176 179199 512.0 KiB FFFF encrypt

19 179200 180223 512.0 KiB FFFF eksst

20 180224 182271 1024.0 KiB FFFF devinfo

21 182272 183295 512.0 KiB FFFF config

22 183296 196607 6.5 MiB FFFF spare1

23 196608 208895 6.0 MiB FFFF fota

24 208896 209919 512.0 KiB FFFF rct

25 209920 212991 1.5 MiB FFFF spare2

26 212992 215039 1024.0 KiB FFFF raw_resources

27 215040 217087 1024.0 KiB FFFF raw_resourcesbak

28 217088 229375 6.0 MiB 0700 drm

29 229376 241663 6.0 MiB 0700 sns

30 241664 262143 10.0 MiB FFFF misc

31 262144 278527 8.0 MiB FFFF persist

32 278528 311295 16.0 MiB FFFF laf

33 311296 344063 16.0 MiB FFFF boot

34 344064 376831 16.0 MiB FFFF recovery

35 376832 425983 24.0 MiB FFFF factory

36 425984 491519 32.0 MiB 0700 mpt

37 491520 5603327 2.4 GiB 0700 system

38 5603328 6012927 200.0 MiB 0700 cache

39 6012928 15253503 4.4 GiB 0700 userdata

40 15253504 15269854 8.0 MiB 0700 grow
[General Topics] Astr4y4L:
Your Host... Is it Linux?

IDA is for windows...

I'm also using this Autopsy tool on windows.

Got 8gb usable RAM

2 HDD's

HD 0 = ubuntu 17.4 with 1.5 terrabytes of storage.

HD 1= Windows 7 with 250 GB storage

2.3 ghz Intel core Duo...

and it gets slow sometimes on some of these tasks but usually it get's the job done...

So what Do you think from the raw output above , do you think we would have any success if we swapp apps from say a Cricket Spree {e1q} to to the zone3 {e1q_vzw} to get the network voice calls crap working?
[General Topics] wdthompson:
[MENTION=8236433]Astr4y4L[/MENTION]

Yes I am using a linux box, radare (&cutter) are pre-compiled for win

reading https://www.qualcomm.com/documents/secure-boot-and-image-authentication-technical-overview

I am not so optimistic about interrupting secure boot
[General Topics] Astr4y4L:
Thus you now see our delima....

so you now see how the Cert chain of trust works...

It's like next level stuff and even our /system is signed but then I found that by mounting the partition in linux I am able to Mod the files and such contained within but can't build a new IMAGE because it isnt signed by LG/Vzw but we can modify the signed images if we don't break signitures...

BUT...

Always a but...

/Aboot as you've stated is an ELF executable and when we change the functions contained within we are changing the bits and thus the code-size which is part of how secure boot validate's the image...

ofcourse if we can find the EEPROM files from LG or qualcom and use the Chip-erase options in LGuP we could possibly compile our own rom and burn it on to the eeprom...

Unfortunately even after signing up at qualcom and becoming a developer over there ... I STILL CAN"T GET THE FILES...

Proprietary Software they claim .... also if you can get the correct files we could get to QHUSB-Bulk mode and use qualcom's QFIL ...

but I think our best bet is to patch the aboot to always return that the image is signed , but we gotta cause the hash of the file to remain the same or once we flash it to the device we just get dead black-screen of doom...

Kudo's on the good reading material...

Astr4y4L