yashsingh1/xdaforums huggingface dataset:
[General Topics] SnakeLake:
Thanks for the link. I think I noticed a correlation with the phones I have. The serial numbers for the PP5 phones I have been able to downgrade without display issues begin with 610CQXXXXXXXXX and all my PP4 phones begin with 610CQXXXXXXXXX. The PP5 phones that I get the display issue on begin with 611CQXXXXXXXXX. Does your downgradable PP5 begin with 610CQXXXXXXXXX or earlier by chance?
[General Topics] Astr4y4L:
On an unrelated note...

After configureing kodi between 3 pc and an android ...

Something can be said for an xml driven UI
[General Topics] jazzdglass:
On another unrelated note, how do I get full log on my phone? It's a T-mobile S7 G930T. I want to use an unlock service (by USB method) . The unlocker will be using TeamViewer to connect to my system while my phone is connected to my system. He says the process is instant. I wish to capture all what he's doing on my phone. The unlock service is pretty costly. About $99.99
[General Topics] MotoJunkie01:
You should be able to install a simple logcat reader from the play store and be able to capture everything taking place via the tethered process.
[General Topics] Astr4y4L:
adb logcat > [your home directory /logcat.txt

And maby route the whole internet connection through another pc and run

ettercap or wireshark or the like to catch all

Network traffic. Analyze the capture files

For the command sent

And find a logcat for the pc running the teamviewer

---------- Post added at 12:56 PM ---------- Previous post was at 12:54 PM ----------

Probably need a good keylogger too
[General Topics] Astr4y4L:
[MENTION=7383447]MotoJunkie01[/MENTION]

Hey bro lookie what I found :) this may be what we needed to figure out our problem.

It involves exploiting /tz to cause a particular qfuse to be blown resulting in unlocked bootloader!

Applicable to qualacomm devices I believe I will investigate this it deals with a Motorola device in the article but I believe it will apply to our zone 3 once modified to our particular bootchain.

Check it out

http://blog.azimuthsecurity.com/2013/04/unlocking-motorola-bootloader.html?m=1
[General Topics] Astr4y4L:
So how did it go bro?
[General Topics] Astr4y4L:
Praying for a new zone3....

Ready to get back to work...

Also going to need rooted testers for modded aboot soon
[General Topics] jazzdglass:
Haven't paid for it. I still don't know much about the log stuff
[General Topics] chwang13:
I wuld love to help/participate in your aboot testing, should I qualify as a candidate.
[General Topics] Astr4y4L:
RE: aboot testing

I will be looking for testers for the aboot mod soon.

I am still crawling through the code for the edit and string modifications.

Soon as I have something that I believe will boot I will post a public link.

REQUIREMENT. ....

YOU MUST NOT. USE THE MOD ON YOUR DAILY DRIVER.

YOU MUST HAVE STABLE ROOT ON YOUR DEVICE.

AND BE COMFORTABLE (or able to learn quickly) WITH ADB AND FLASHING WITH LGUP

AND YOU'RE PROBABLY GOING TO GET A BRICK.

BEING THE ABOOT IS PART OF BOOT CHAIN YOU WILL NOT RECOVER USING LGUP.(I think)

So if any one is still interested in testing this I will try to hopefully have the first link up this weekend.

Thanks
[General Topics] Fixup:
Have you got GSM to work?

I tried these posted by motojunkie01:

telephony.lteOnCdmaDevice = 0

ro.telephony.default_network = 3

ro.telephony.gsm-routes-us-smsc = 0

Seems no effect on phones that came with PP8, downgraded to PP2 and root with Astr44y4L package (thank you!).
[General Topics] Astr4y4L:
RE: gsm mod

I have successfully hacked a lte data connection from zone3 using the above modification plus I disabled a few system apps "anything Verizon " and changed some network things like /system/etc/apns.xml and some stuff in /data/data/com.android.telephony

---------- Post added at 08:25 PM ---------- Previous post was at 08:22 PM ----------

That was on a cricket sim card

And I never got voice to work.

But its absolutely possible given research and determination that it will be coming soon
[General Topics] Astr4y4L:
Well. Ive been decompileing aboot all day scrapeing back and forth through the code.

We had hoped to re-enable our fastboot functionality and bypass the the secure boot problems...

But its going to be a no go on fastboot as the appropriate code to call the functions simply are not written in the code as far as i can tell. But we may be able to beat secure boot still looking at relationships between aboot ,tz (trust-zone) and qualacoms qseecom and i also think a lot of what i found here in a securitypatch bullitin could apply .especially the vurlnerability in the qualcom bootloader

Give it a read

https://source.android.com/security/bulletin/2016-08-01

And of course we would be able to change all kinds of fun and interesting things if we are executing arbatrary code during the bootprocess running under the context of the kernel its self... [MENTION=7383447]MotoJunkie01[/MENTION] ,

If you remember which lg varient had success with the laf-nukeing fastboot thing please try to get a copy of the exploitable .tot or .kdz or the boot sbl1 sbl2 Tz and aboot partitions .

I dont think i can add fastboot back to aboot, sha256 hashes and all that... unless we can find lg's signing key...

But with a few hex edits i may figure out how to trick it into allowing the aboot from say a G2 or G3 OR SOMETHING !!!!!. Im still pulling my hair out on this one...lol

Too bad im not more knowledgable about codeing in pure assembly...

Uggg....
[General Topics] MotoJunkie01:
Great work. The G2 and G3, as I recall, were the two main devices susceptible to the eradication of the /laf partitions. True we may be able to flash an /aboot partition to the Zone 3 from a G2 or G3, depending on the similarities in the partition indexes, partition image sizes, etc. Hopefully sha256 checksums won't impede us there. I can get the /aboot partition images from both the G2 and G3, so I'll be digging through my archives for those.
[General Topics] Astr4y4L:
Great , because my linux boxes identify this and the spree as lgg2 when i issued

# lsusb -v

And so that simply means it uses the same driver in linux...

But lg/qualcom are not going to go out of the way to change much of the base code like that between devices because they have to use the same software to program every device regardless of model... flagships included. So im hopeing they kind of got lazy and used basicly the same code between devices. Except that the newer models were patched against this very flaw...

But if we can replace the entire boot chain with that of a similar platform same SoC

Then maby it would work. We vould then only have to modify the end of the process so that it doesnt lokc up at booting /system ..

And i was reading about lokki and how it exploits things to get bootloader unlock....

(Still hammering on the moto g) so ive noticed that all the qualcom chipset devices are very simialar in how trustzone and boot processes work.

I mean if they patched a problem in a wifi driver for instance it gets pushed to all the devices Ota. You can see evedince in build.prop.

So if a prior kernel was exploitable in aboot or something all we gotta do is find a way to replace our kernel or whatever with the older one and then exploit the krapp out of it..

Thats basicly how we got root now anyhow... then we flashed those images i made from dissecting pp7 and that stopped the boot loop, well long story short that might be how we do it .

Does anyone have the very first release of zone 3 software.?

Was it exploitable by zeroing /Laf ?
[General Topics] MotoJunkie01:
Yes, by simply zeroing /laf, here is what occurred: /laf, as you know, is Download Mode on most LG devices. So when you commence to boot into Download Mode, /aboot searches for the kernel within /laf. When /laf is zeroed, /aboot searches for the /laf kernel, and when it finds no kernel, fastboot mode is forced.
[General Topics] Astr4y4L:
And by looking at aboot source c0de [LITTLE_KERNEL codearrora]

We know that the fastboot is a part of aboot [includes-fastboot.c] etc. ,

So when no kernel is found at offset [laf] it falls back to fastboot but exactly where is the kernel that fastboot is running on?

It aint in offset at laf as we zero'd that right?

And so far as i can tell aboot is an arm bianary program .... not a rom or kernel.

It doesnt have a ramdisk so does it point to fastboot running on the kernel and rdisk located in /boot. And if so wouldent we need to modify boot and also bootbak or whatever to get the actual functions out of fastboot?

Its a lot of headache trying to sort it all out....

If anyone with rom porting experience wants to chime in id love to hear some feedback. We need to model our boot after that of the g2 and use our own partition index and stuff but its all a lot of guesswork and then trying to confirm our guesses...

So we need aboot to be modified to boot any boot instead of signed boot and im working out now how to edit that.....
[General Topics] Astr4y4L:
LOOKING FOR TESTER...

MODIFIED UNSECURE BOOT WITH ADBD INSECURE AND A FEW OTHER SMALL CHANGES

WARNING THIS MAY JUST BRICK YOUR DEVICE

I CANT TEST BECAUSE MY ZONE3 IS NOT FUNCTIONING :)

PLEASE ONLY TRY THIS ON A THROW AWAY DEVELOPMENT DEVICE

I DO NOT KNOW WHAT IT WILL DO

But yep somebody please rooted using downgrade + Astr4y4L root method

download this file http://www.astrayalslanding.dynu.net/testing/Frankin_Boot.img

use the partition tool installed in the root process to restore this image to boot partition and afterwards see if we boot or if we die, and please let me know the results.

test adb root command :) if we boot

happy laborday weekend USA
[General Topics] troptard:
zone 3 root

Hey Motojunki01 and Astr4y4L

I confirm that your script to root and get rid of endless bootloops works.

Here are some typos in READ_ME.rtf that you may want to consider fixing:

1. adb install "rom-toolbox-lite-6-0-7-0"

".apk" is missing. Also this version of rom-toolbox-lite failed to install with an error "Failure [INSTALL_FAILED_DEXOPT]."

Installing the most recent version from GooglePlay worked fine.

2. kingroot requires many reboots. So be patient.

3. in mrw/root.sh

Line 23:

cat /data/local/tmp/mrw/busybox > /system/bin/busybox

->

cat /data/local/tmp/busybox > /system/bin/busybox

Lines 40-42

cat /data/local/tmp/mrw/su > /system/xbin/su

cat /data/local/tmp/mrw/su > /system/xbin/daemonsu

cat /data/local/tmp/mrw/su > /system/xbin/sugote

->

cat /data/local/tmp/su > /system/xbin/su

cat /data/local/tmp/su > /system/xbin/daemonsu

cat /data/local/tmp/su > /system/xbin/sugote

Line 79

pm install /data/local/tmp/mrw/Superuser.apk

->

pm install /data/local/tmp/Superuser.apk

4. The default location of Partitions Backup is the internal SD card. Change it to External SD.

Everything worked. Keep up the good work. Now if only GSM were enabled.
[General Topics] Astr4y4L:
Thats great im glad it worked for you ! You are right the readme was done in a hurry, and has had life on 2 different servers. There is a revised git version that im meaning to replace it with and the romtoolbox apk must have gotten corrupted in copying the orig. Package between servers back in the takedown of a month or so ago.

Thanks so much for your input as now i need to compare your notes to the revised version and make sure its all fixed.

about the gsm-DSU thing :

I think it is totally possible. I also believe it would be a million times easier to write an xposed module comparable to X teather that would fix this.

But alass im more of a hands on direct kind of guy and i dont know how to build any xposed module...

With a lot of try this&that i managed a data over lte connection using a Cricket sim card and the before mentioned prop edits but i also changed apns.xml file with that of a samsung galaxy amp2 (cricket phone) and modified all sorts of values in databases located in /data/data/com.android.providers.telephony or something like that.

So as i can not directly tell you how to do it i can tell you where to look so you can help all of us figure it out ;)

see as of late iv decided that if [MENTION=7383447]MotoJunkie01[/MENTION] and myself can figure out the boot processes associated with aboot and boot we can make TWRP possible and that would open the door for quick flashing our own ported rom [Frankin_Mod]

And if we flash a ported rom it can be a given that afterwards i can put any tmobile at&t verizon or any gsm simcard that operates on the radios supported bands.

Now thats a discussion for [MENTION=7383447]MotoJunkie01[/MENTION] he knows quite a bit more about that than i do [radio bands and all]

Thanks

Astr4y4L
[General Topics] Astr4y4L:
[MENTION=7383447]MotoJunkie01[/MENTION]

Hey Bro hacked lgup for all functions

One file to rule them all
[General Topics] MotoJunkie01:
Wow. Seriously? That's impressive stuff. If you don't mind, I'd like a beta release of your modded LG UP whenever it's convenient. Thank you and once again, great work ....
[General Topics] Astr4y4L:
Hey Bro!

check your messages!

RE:LG_UP_YOURS :)

and let us know how the method works for you :)

still working out the unknown model comport bricks problem

an if i can please get that kdz for g2 i'll pull the aboot and compare them

---------- Post added at 07:58 PM ---------- Previous post was at 07:51 PM ----------

Screenshots attached

---------- Post added at 08:00 PM ---------- Previous post was at 07:58 PM ----------

Im dumping all partitions on my bricked spree right now

:)

---------- Post added at 08:02 PM ---------- Previous post was at 08:00 PM ----------

Or mmaby the screenshot didnt load...
[General Topics] MotoJunkie01:
Ok got it brother. I'll install it to my Windows laptop in a little bit. I won't share the files with anybody, as you may want to actually publish this work or, at the least, post it in a donate-only development thread. This is quite an accomplishment. Thanks again.
[General Topics] Astr4y4L:
Now If only I had a Working Zone3 to play with the Phone Settings option. I believe thats how we enable LTE and GSM

along with proper edits to build.prop

yes I am trying to rebuild the LG_UP installer to add my file automatically but its a little more complicated then just adding my file to the damn msi installer apparently i need to add it in the Common folder in the other installer...

I am trying to figure out how to make it accept the bricks with (UNKNOWN) model on Com imput... then I can get like 2 or 3 zone3's going again...

also DO NOT USE THE (CHIP ERASE) OPTION IT KILLED THE SPREE COMPLEATELY

I am working out how that works to be able to (Chip_erase ) A phone and then flash alternate firmware... such as turning a zone3 into a Global K4...

but...

I Need A Device to work with...

AHHHHHH so frekin close!!!

and you may actually have to holler at me in a PM and explain the Donate-only Dev thread
[General Topics] Astr4y4L:
Ok so I'm Now working to try to get these bricks recognized by lg_flash_tool since it doesn't appear to care what model/device it has as long as it can see the port on Comm, it is a dumber version of lgup basically but uses the very same protocalls . I'm following along with a G5 unbrick scenario where they use several other tools to dig the needed files out of firmware but i've already accomplished that long ago, now I have an idea what these files can be used to do. my longest standing bug is the damn comm ports and stuff but i believe i've just learned a little trick with that so im waiting for the vs425pp2.dz i created over at the server to finish downloading and we'll see if i can finnally get flashtool working for that. if indeed i get this to work we'll have the ultimate toolbox for our devices.

i've successfully created a mod for lgup that auto-magically opens ALL options that are supported for any version of lg-up tested on our lg_up store version and on earlier lg up DEV version too so i believe this mod is universal.

i'm going to get all my findings and the tools i use together with a good write-up with instructions for noob-friendly instillation and I will be releasing my tool_box package in 2 Stages.

Stage 1 : first 6 xda users that reply (Reserved ) to this post will get my Beta_Release of Zone3_Toolbox.zip for testing and so someone else can post screen shots of success on installation and also see what all these goodies do :)

Stage 2: Final Release Of Zone3_Toolbox.zip will be moved to a new thread and at that time the file will only be available as a consolation for donations.

so if your following this thread as a regular and consider yourself a Hardcore Power_User or A Dev or A Tester Here's your chance to save hours of work trying to re-write software.

get it now :)
[General Topics] Astr4y4L:
[MENTION=7383447]MotoJunkie01[/MENTION]

UPDATE :

I HAVE JUST GOT BACK 3 OUT OF 5 BRICKS THAT I THOUGHT WERE UN-RECOVERABLE !!!!

THE 2 THAT CAN'T YET BE SAVED DO NOT GO TO DOWNLOAD MODE THEY ARE STUCK IN QHSU-BULK (QCOMM-MODEM) MODE

BUT ALL THREE THAT I HAVE BEEN COMPLETELY UNABLE TO RECOVER ARE NOW OPPERATIONAL .

I now have a working daily driver plus 2 for testing purposes .

soon as i have time to assemble the toolbox and instructions i'll PM you with it :)

now i gots some rootin to do then i'm gonna play with Boot and Aboot somemore.

wow

i guess the LK bootloader or aboot or something has a really cool looking splash screen says Mini OS with arrows going up and down it was Kool !

the best part ...

I just saved a ton of money with Gieco

no but really, $26. a piece times 3 =$76.00

i consider that a good reward for my time spent banging my poor head on the wall!

Get your reservations now 6 beta copies will be sent out and then after we test everything , the customized tools will be for my friends who support my work with donations .

will be revisiting the zone3 root zip to add in the revised readme and fix a few things with the scripts.

WoW

Blew My F''kin Mind With This One ;)
[General Topics] MotoJunkie01:
I'm without words. Remarkable work brother! You persist daily in making headway for our Zone 3s. Guys, members if this thread, please help support the development of [MENTION=8236433]Astr4y4L[/MENTION] with any donations possible. He puts me endless hours and resources into this device. Even if it's only a buck or two, every little bit helps.
[General Topics] Astr4y4L:
Update

Now have 4 out of 5 bricks fixed

Wooohoooo I'm on a frickin roll. !!!!
[General Topics] jazzdglass:
That's great! I can now mess with the build.prop all I want with no fear of brick?

How do I reserve a slot for the beta
[General Topics] Astr4y4L:
Reserved

You sir are now reserved.

And yes I believe as long as you can get to download mode

We can make this puppy do tricks.

Ya may Want to wait till I have instructions and the toolbox uploaded and ill pm u your link sir ;)

And that leavez 5 reservations left not counting [MENTION=293243]Motojunki01[/MENTION]

He gets first download :)

---------- Post added at 07:42 PM ---------- Previous post was at 07:39 PM ----------

I absolutely abhor autocorect
[General Topics] Astr4y4L:
I am currently compressing the archive

For upload its pretty large so I'm using 7zip

Since its reliable and free and windows...

Depending on time uploading to server the first download may be available tonight.

The beta release doesn't have every option. Available.

But it does have more than the unmodded versions. Available

It includes several more options useful for unbricking

The things I deemed useful for rom development I am saveing for the donate package.
[General Topics] Astr4y4L:
Tried uploading through webbrowser lastnight and after running all night it only had half of the file so iv erased that and I'm setting up winscappy or some krap. To use sftp to upload instead its processing the files now...

---------- Post added at 10:32 AM ---------- Previous post was at 10:13 AM ----------

This file transfer is taking 4 and a half hours

---------- Post added at 10:39 AM ---------- Previous post was at 10:32 AM ----------

But seems stable.

Any who I'm going to try to write my modded boot to one of these zone3s and see if it will boot. Thinking I may just get secureboot error. But then wont know till we try. Going to try to force it by using lg up to flash the modded boot to the device using an option called partition download
[General Topics] Astr4y4L:
Ended with a toaster but ill recover it later.

Anyways

My beta toolbox is now available.

Please let me know how the files integrity turned out.

If needed ill put it on a thumbdrive and upload it from somewhere with a fast connection. Mines a trickle
[General Topics] Astr4y4L:
@ MotoJunkie01

well Krap !!!!!!!!!!!!!!!!!!!!!!!!

Toasted again... I Have now an /aboot from zone3 thats compleatly patched to bypass sig. verification.

Thanks to @pvineeth97

only problem is that aboot on the zone 3 is signed by LG so by patching , the size of the code changed and thus the Header + codesize + Cert = SHA hash for signed image has changed resulting in a Null-Boot state

so from our previous look into LittleKernel/aboot we know that the signature (hash) is equal to

Header + codesize + Cert

I'm just thinking the only thing that has changed in our new modded aboot is the codesize

and that the extra few lines of code have increased overall codesize and thus changed the hash.

so the end of aboot is basically empty space ( a bunch of zeros) and I have to wonder if we could delete some of the zeros to make the code size match again and thus the Hash would be the same again?

and i'm sure @pvineeth97 would be very helpful with this endevor but he needs to be contacted on the Tele or on Whatsapp

I don't do watsapp and i contacted him over the tele but it ate my longdistance allotment in the time it took to explain who i am..

SO,

does anyone know how to recover from the corrupted boot state?

all i've got on comport is

qualcomm hsusb qdloader 9008

i'm trying to work out a method for flashing the whole boot chain to devices in this condition.

i'm looking at a program called QFIL

Qualcomm_Flash_Image_Loader_v2.0.0.5

but it requires something called firehose .mbn and several other files (rawprogram0.xml)

and partitions.txt or some krap.

does anyone want to help figure that out?

also looking at a LG tool called BoardDiag3.99c

but we would still need to create the required files and i'm burnt from reading about all these programs and what they require and trying to create it all from scratch...

ANY HELP WITH THIS PLEASE ANYONE WHO KNOWS ANYTHING ABOUT THESE PROGRAMS OR THE QDLOADER BOOT STATE PLEASE SPEAK UP

Thanks

Astr4y4L

https://xdaforums.com/member.php?u=7045959
[General Topics] Cubcadetlover:
I am not necessarily interested in the special access to the beta testing files, but I am thankful for your work. I tried clicking "Donate to me" under your name and ended up with a PayPal error. Are you sure the link is working?
[General Topics] Astr4y4L:
Oh WOW THANKS FOR LETTING ME KNOW ;)

I Have fixed it I believe but just in case of button problems

donate via paypall to

beccastroble@gmail.com

And thank you for your donations you guys that donate for my work are truely the Bread&Butter of my development carrier

And You Sir will get a pm with a link for my finished toolbox as soon as the beta test period is complete

and If you should need it it'll be there for you when you should decide download it

Thanks

Astr4y4L

---------- Post added at 08:48 PM ---------- Previous post was at 08:28 PM ----------

Well I just got done negotiating with Qualcom about the Development Kit for Android MSM8909 (Snapdragon 210)

I believe the stuff they have at the chip manufacturer may be able to help with our various states of Krap

SO Now I'm Waiting to hear back from them regarding weather they will grant me further access to files and programs over there...

but anyways all that took quite a bit of blablabla so i'm done for today..

see you all tomarrow

Astr4y4L
[General Topics] Cubcadetlover:
Works now... Check your inbox for PayPal