yashsingh1/xdaforums huggingface dataset:
[General Topics] Astr4y4L:
Actually working on it as we speak

got Two ideas ....

will be back in a bit...
[General Topics] Astr4y4L:
[MENTION=7383447]MotoJunkie01[/MENTION]

i found this...

[ https://xdaforums.com/showthread.php?t=2483250&page=5 ]

lastpost...

[ " I merged system.img (2206203904B) with SystemMerger.py but it's larger than my original system dump which is 2147483648B size...

The difference is 58720256B which is exactly 56MB.

As on the end of merged system.img are ony zeroes I truncated merged file to size of original system dump as that is the size of my system partition. Bigger than that won't fit...

Merged system.img is still readable after truncation... " ]

I think this is how i trim new system to fit....

also some good tools for Windows Users.

[MENTION=8451188]SquaredDev[/MENTION]

I am slowly downloading pp2 again and going to try two things .....

idea 1 (System_Only_PP2.kdz)

and

idea 2 (PP7_Without_System.kdz)

if either of those will flash through lgup you'll be joining Club_Root ! :)
[General Topics] SquaredDev:
Awesome! I may not admit to it, but I have been refreshing this forum quite a bit today. (Every break I get, I drive a semi) I have been playing around with python a bit today as well while waiting at a shipper.. going to learn the language :D
[General Topics] Astr4y4L:
[MENTION=8451188]SquaredDev[/MENTION] [MENTION=7383447]MotoJunkie01[/MENTION]

Try this in LgUP its a kdz containing only the system parts and the GPT wrapped up with the dll files and such that were there to begin with

direct download link ( http://18.220.133.114/android/Astr4y4L_VS425PP2_02.kdz )

im done for today.

please post any results here and i'll check back in the morning.

Astr4y4L
[General Topics] SquaredDev:
These were the results.. the first error is trying via the refurbish and upgrade option. The second is from the FOTA option. Test subject was a fresh flash to pp6 and then tried the kdz you created.
[General Topics] Astr4y4L:
Ok I got another idea from the errors ...

---------- Post added at 08:04 AM ---------- Previous post was at 07:45 AM ----------

[MENTION=8451188]SquaredDev[/MENTION]

Ok try this out same setup except I compiled the last one with a new name... so download first this kdz

( http://18.220.133.114/android/kdztools/VS425PP2_02.kdz )

Then id like you to download this...

( http://astrayalslanding.dynu.net:88/Android_Development/Projects/UPPERCUT_1.0.0.0.zip )

And unzip that and run the upputcut.exe inside as an admin.

This will rule out problems with the dlls

What this does is bypass the dlls for lgup allowing any lg phone to connect . Uppercut is not my work but I use it and it starts lgup for me and connects everything.

So grab the kdz then use uppercut . It will automagically start lgup for you then try refurbish and such as usual.

Plz post results. Thanks.

Astr4y4L
[General Topics] MotoJunkie01:
[MENTION=8236433]Astr4y4L[/MENTION] sorry I'm so late chiming in. I'll download the files today and try too.
[General Topics] Astr4y4L:
Well I wonder how it went...

Are the files I'm making doing anything?

If they're no good let me know so I can reclaim space to work in...

If they are good I'll move them to main project page for everyone else to use...

Just let me know .... [MENTION=7383447]MotoJunkie01[/MENTION]

Did you happen to figure out anything on aboot? Did you try the one from the rebel?
[General Topics] SquaredDev:
I am getting KDZ file is invalid, now
[General Topics] MotoJunkie01:
I'm currently trying to achieve root or temp root on my Rebel, which has proven to be very difficult. The typical one-click root applications have not hit upon an exploit. I'm trying the old dirty cow in hopes temp root will occur so that I can dump the partitions.

On the firmware package you created, I just arrived at work and when I get a few moments, I'll use LG UP & try flashing it.

Thanks as always [MENTION=8236433]Astr4y4L[/MENTION] for your endless hard work and contributions.
[General Topics] SquaredDev:
[MENTION=8236433]Astr4y4L[/MENTION] Is there anything I can be doing to help you? I have no problem test flashing, but was wondering if there is anything extra I can be helping with that isn't complicated for a noob?
[General Topics] Astr4y4L:
Awsome.... wonder if u can use kdz to tot windows tools to convert this to a .tot file?

we could then use LG flashtool instaed of lgup.

Wich would be great because this seems like a checksum error...

Well... back to the drawing board...

Ill be thinking about a way around this problem ..

But honestly. Buy the pp7 or pp8 from familydollar

It's $20 I fried my first one trying to figure out the ZONE3_root.zip I made....

But still I hate that I can't fnd a way to do pp5...

I will be thinking...

---------- Post added at 07:18 PM ---------- Previous post was at 07:12 PM ----------

Can u find a source to download the .kdz firmware for the rebel? I can easily take kdz apart to get working partition .img files as demonstrated with the vs425

---------- Post added at 07:30 PM ---------- Previous post was at 07:18 PM ----------

Let me see.... I really wish u had the pp7 device...

Mine is my daily so I get tired of flashing back and forth..

But outside of that if you want to research. Tot files, how to make ? Kdz how to convert to tot. ? And lgflashtool...how does that work and does it need specially crafted libraries to connect to com port on our phones?

My windows machine along with all my prievious work are shot for now I'm running linux exclusively but many of the tools made out there are for windows ..

We need a less strict flahing tool or maby use ollidbg to modify lgup so it doesn't do sanity checks....
[General Topics] MotoJunkie01:
I'll look for the Rebel firmware. If I can get at least temp root (the bootloader on the Rebel is locked), I can dump all partitions and upload them. There is a Windows tool I think that can convert raw partition images to kdz (and maybe TOT???)

Also, the LG Spree LTE is supposedly the same phone as the Zone 3, Rebel and K4.
[General Topics] Astr4y4L:
Ok it just hit me.....

Instead of. PP7 no system or pp2 system only....

Why not pp7 replace system chunks with pp2 system chunks then make kdz..... maby it'll fool lgup

---------- Post added at 02:48 AM ---------- Previous post was at 02:45 AM ----------

Gotta work in the morning so I don't have time tonight but...

COMEING SOON...

PP7_WITH_pp2-system.kdz [MENTION=8451188]SquaredDev[/MENTION]

This means u.....

---------- Post added at 02:48 AM ---------- Previous post was at 02:48 AM ----------

Gotta work in the morning so I don't have time tonight but...

COMEING SOON...

PP7_WITH_pp2-system.kdz
[MENTION=8451188]SquaredDev[/MENTION]

This means u.....
[General Topics] SquaredDev:
That's awesome! I have been looking at ollyddb and trying things as well. Really cool program!
[General Topics] Astr4y4L:
Yea. If u get good at that u can basically cheat at anything (windows)

I will fire up the server again tomorrow and make this new idea on kdz
[General Topics] SquaredDev:
Sounds like a plan! I got a lot of shag runs tomorrow afternoon with the truck, so i may not be around much past noon but will get to it soon as I can!
[General Topics] Astr4y4L:
here it is i took pp7 and replaced system parts with pp2 and just wrapped it back up....

wanna give it a shot ?

i'll check back later to find out how it go's...

NEW KDZ

( http://18.220.133.114/android/new_kdz/VS425PP7_01.kdz )

MODIFIED KDZ PP7 WITH PP2 SYSTEM FLASH AT YOUR OWN RISK...

but I ReeeeeAly hope it works ! :)

Astr4y4L
[General Topics] SquaredDev:
Giving me the same error.. saying invalid kdz on upgrade/refurbish but FOTA is giving me the error code from previous post. I thought I may have broken the program but it still flashes the unmodded kdz files.
[General Topics] Astr4y4L:
Ahhhhh! PP5 the bane of zone3 rooting....

Well without a way to see the screen after downgrade ...

No way to root it that I can think.. now if they haven't changed the kernel even pp5 should be susceptible to dirtycow but its very involved and quite complicated to get root through dirtycow methods ....

The $20 price tag makes this my favorite device for now.

I can just buy another one if I kill it...

But ill still be thinking..

There may be a way to dirtycow it to trick it into flashing or UPDATING its. Self to pp2...

There was a thing for lg v20 that did basically that to the recovery...

We'd have to write our own code or heavily modify someone else's ....

[MENTION=7383447]MotoJunkie01[/MENTION]

Any luck with dirty cow?
[General Topics] Astr4y4L:
well if anyone needs stock .img files for any partition in pp7

get it here

( http://18.220.133.114/android/PP7_all-partitions_stock_img-format/ )

maby someone can find something to exploit in pp7 now that all partitions are available in mountable .img files
[General Topics] MotoJunkie01:
No. Dirty cow won't exploit it for even temp root. It's one of the tightest Lollipop ROMs I've ever ran across.
[General Topics] Astr4y4L:
think I may be on to something with aboot, but don't got time to chase it right now...
[General Topics] Astr4y4L:
[MENTION=7383447]MotoJunkie01[/MENTION]

about dirtycow did you try this

( http://www.mediafire.com/file/r3i900n7jb2zfoo/EXPLOIT_ADB.rar)

password = nox

this was from thread ( https://xdaforums.com/android/software-hacking/root-tool-dirtycow-apk-adb-t3525120 )

it probably won't work out of box as written for our device but the exploits can be used to dirtycow other files... i don't know what that means to pp5 but for those of us with root this could be a back door to twrp like with the v20

we would have to write our own script to set selinux to permissive and then flash our twrp that we place in /data/local/tmp/

find one of the scripts in the rom that runs in the init context and hijack the process useing dirtycow to replace said "script.sh" in the memory and cause the event that triggers "script.sh" to be executed which would flash our recovery..... maby...

dirtycow its self will not give us a real root shell because of selinux but it is a tool we could implement to achieve root or custom recovery in a round-about way...

also I found ( raw_resources.img ) and ( raw_resourcesbak.img )

in the firmware and looking through the shell scripts in boot and in system i'm fairly convinced the problem with the unsecured boot is located in aboot also the problem with fastboot is there and of course thats because it points to laf

but I now think the issues with recovery may have something to do with these two partitions i found. also noticed (spare1) and (spare2) and would think they would be extra space but it contains data so what the heck are they hideing in there ?
[General Topics] MotoJunkie01:
I've had great luck with DirtyCow in the past, with various devices & tablets. I'll try the script you sent and see if the exploit will take. Thanks for your research and your help.
[General Topics] Astr4y4L:
I just really eant to see that twrp u r working on

And want to help any way I can.

I stumbled across some imgtool that did "something " to aboot.img but I haven't had time to figure it out yet....

Still maby we find out what's inside /rawresorces or whatever it was called.

Maby that's where it pulls the img from when it rewrites our recovery ...

Wonder what happened with everyone else?

Did that guy figure out anything on his cwm ? Or /laf ?
[General Topics] MotoJunkie01:
We simply need to "nuke" /laf and there is a possibility of accessing fastboot. It has been done on many LG devices. /laf is your device's Download Mode for recovery, so of course there is a chance of bricking a device beyond repair. I'm about to the point of chancing it.

On TWRP, as soon as I have it rebased (I'm also developing on Lenovo Tab 3, Moto G3, and Alcatel Ideal right now), I'll link you a copy of it. Won't be long I promise.
[General Topics] Astr4y4L:
Awsome... ill try it too...

I'm taking a break from cracking this. I am in the middle of remodeling my house....

But I am going to leave everything as it is on the servers so you have all my work right there...

I'm sure ill get back to it again soon. But I was thinking of making another sudo account and letting you log in if u want to continue what we are doing with littlekernel and aboot etc.
[General Topics] Astr4y4L:
[MENTION=7383447]MotoJunkie01[/MENTION]

hey check your PM 's I just sent you a message containing the login for the development-server
[General Topics] MotoJunkie01:
Thanks [MENTION=8236433]Astr4y4L[/MENTION]. Just saw this. Been working 16 hour days. Been crazy.
[General Topics] Astr4y4L:
Still having issues with the gsm mod... trying a few things but can't find your OP on the topic ...
[General Topics] MotoJunkie01:
I didn't do an OP. Its on Page 3 of one of the Zone 3 threads.
[General Topics] MotoJunkie01:
Find apns-config.xml if you need to further edit APN settings.
[General Topics] Astr4y4L:
[MENTION=7383447]MotoJunkie01[/MENTION]

Ok I have limited success. after adding the internet APN settings from my wife's Samsung to this device I have been able to get LTE connectivity for internet but I still cannot make a voice call... guessing that's due to the phone looking to use 1x network for voice and I'm not sure how to remedy that .

Any ideas?
[General Topics] Astr4y4L:
does anyone know anything about VoLTE and how I may add the functionality to this phone if not present?

apparently thats the issue ....
[General Topics] MotoJunkie01:
I can get you a flashable zip that may implement VoLTE framework.

I have a zip for Moto G3 to install Volte Framework. I'll modify it to the msm8909 specs and link it to you
[General Topics] Astr4y4L:
Kool .if / when I get that all figured out i might make a tut. on the topic... But probably be a day or two since I KILLED ANOTHER ONE last night....

messed-up build.prop again somehow and on boot got blank screen tried to flash back with LGUP and lg up says it is UNKNOWN device now....

tried to factory reset hopeing it may revert....

Nope.... SO theres another brick in the wall ...

after that it doesn't show up in "adb devices" so yep...

ATTENTION ZONE 3 USER !!!!

DO NOT EDIT BUILD.PROP AND CHANGE ANYTHING THAT IS A IDENTIFIER OR YOU WILL HAVE A BRICK ON YOUR HANDS AND LGUP WON'T WORK...

But with the $20 price tag it's nearly impossible for me to resist going out and getting another one... especially since the sim's active from the one i just killed and

I JUST PAID the BILL :)

so reckon i'm out of the race for a day or two...

and the next thing I want to work on is reverse engeneering LGUP to bypass sanity checks and just flash a stinking file..

no more protecting the user from his stupid actions just flash the damn file...

so yep that would give me three more working phones...

Happy Hacking

Astr4y4L
[General Topics] Astr4y4L:
Alright... back in buisness.went and got a replacement this morning already rooted it and fixed bootloops so i'll be back to trying to network mod this one after a bit...

New one is pp8 version... there was only 2 phones left on the shelf and looked at the box closely and saw a pp8 and a pp5...

I bought the pp8.

If i had more money id get the pp5 just for experimentation purposes....

But anyhow. Soon as i get the network stuff figured out ill post a tut...
[General Topics] jazzdglass:
I appreciate your efforts in this little device.

I'm on pp5. How do I go to pp8 so we can be on the same page with you through the process?

I got this $8 off ebay. Didn't know it was cdma phone then. I'm highly hopeful I can get GSM working seeing your input. Thanks once again
[General Topics] TMcTestface:
Hi all,

Thanks for all the information in this thread and others, it's been extremely helpful to understand the rooting process. Just picked up a Zone 3 today for the sole purpose of rooting and doing some app RE (software version is PP8, as others have noted), and when running the VZW Update agent in an attempt to downgrade, I run into an error message that says "Device authentication failed: please check your device whether it has valid IMEI" (grammar errors not my own). Naturally I assume this means the device must be registered with a data or phone plan, which I don't feel like getting, as I'll not need it. I might be able to just patch the Windows update agent binary if the IMEI isn't critical to the update process (I can't imagine it would be, it's just flashing an image), but I wanted to reach out here and see if there was anything that could be done to "activate" the device without paying for a plan, or otherwise get around the error. Googling the error message turns up nothing as well, so I don't know if anyone else has run into this issue.

Thanks all for the help!
[General Topics] MotoJunkie01:
This is a CDMA/GSM device. For example, the LG Rebel LTE, which is the exact same device as the Zone 3, uses the GSM networks as primary. Upgrading from PP5 to PP8 has been shown to cause video driver issues for some yet to determine reason. [MENTION=8236433]Astr4y4L[/MENTION] can explain this a bit clearer than I.
[General Topics] Astr4y4L:
Only problem is some pp5 have display issue once downgradeing to pp2

All u can do is try to upgrade to pp8 useing lgup then soon as it reboots pull the battery before system boots go back to download mode and flash pp2 with lgup and use the (upgrade) option in lgup and if it boots up without going all black and white bars u r ok...

you will expect bootloops on flashing pp2 but if u dont get the Display issue phone will eventually boot up then you will have to download my rootpackage and follow instructions to root and fix bootloops then you will be good to go ...

Working on the gsm thing just dont have much time so i get in a hurry...

Sometimes thats a bad thing... this is the third one i've bought because of that...
[General Topics] Astr4y4L:
Use lgup not verizon update uninstall that shizz and grab lgup from post 1 of this thread
[General Topics] Astr4y4L:
Just reread your post...

If u know how to patch a windows bianary i could really use some help. as iv said before i need lgup patched to either skip file check/version check or somehow return the same values no matter what... (so it just flash the file... dont check version or phone model )

If we do that a rooted pp7 or pp8 or even pp5 would be posible...
[General Topics] Astr4y4L:
Well darn...

I can't get the new to work like the one i killed tried all the edits i can remember but no connectivity on other sim
[General Topics] jazzdglass:
I feel with root it should be easier. If one can enable USSD code on the phone and then proceed to dial *#*#4636#*#* - this will bring up the phone info tool and in it one can choose network mode. Most verizon phones disable USSD code. There is an app on playstore that brings that phone info page but it doesn't work on my zone 3 vs425pp5. You can try on pp8.

Here is the app https://play.google.com/store/apps/details?id=com.tapbase.LTEswitcher

Also see this video where someone used USSD code to open the phone info page https://m.youtube.com/watch?v=s-7R6I8IPQ0

If this were a Samsung phone, I could easily use phone info app by vndnguyen on playstore to enter engineering mode and select bands manually (with root).
[General Topics] jazzdglass:
Just tried this. I pulled battery after flashing pp8 and tried to boot on verizon screen. Now flashed pp2 and everything seems working. Phone seems slower though. Takes a while for apps to open
[General Topics] Astr4y4L:
Kool it worked :) mine seems to be a lot quicker and more responsive just by flashing xposed and i use gravitybox and usually tweak the colors and stuff.. stay away from changeing android identifiers otherwize you'll end up stuck if anything gos wrong

---------- Post added at 12:51 PM ---------- Previous post was at 12:20 PM ----------

The reason i recomend the xposed installer included in my root package is it will write directly to system so you dont have to have recovery to flash. After that it reboots the first time and triggers it to re-odex or (android is optamizing apps) or whatever and it does all 163 apps which takes a little while but it runs so much better after that.

Also be careful working with build.prop or any .prop and if u use gravitybox stay away from radio or telephony stuff.

And do i remember right ? You started at pp5 ?

If so maby we have a general method for the pp5 to take the downgrade...

[MENTION=7383447]MotoJunkie01[/MENTION]

Did u see this
[General Topics] jazzdglass:
I cleared cache and did factory wipe. Now it runs normal. Yes I think the downgrade went well. This was all I did-

I installed LGUP, then installed LGUP vs425pp. (this might be elementary but for someone like me flashing an LG for the 1st time I initially installed just LGUP and had trouble for the app recognizing my phone), then I went into download mode by holding down volume up and connecting USB cable to phone and pc. Launched LGUP, selected my phone, chosed upgrade, selected pp8 and flashing started. Phone stared to reboot at 95% and once verizon red boot image showed I pulled out battery. Then retried the whole flashing but now selected pp2. One may have to do factory data wipe in recovery to get things smooth. And don't forget to remove your Google account. As I spent 2hrs to remove frp lock even my Google denied my email and password saying it was wrong. Lol

I don't think I can afford staying away from meddling with GSM stuffs. This phone is almost useless to me without the GSM working.
[General Topics] Astr4y4L:
Awsome :p then we can figure it out together.. compare notes.. etc. My goal is to use both my wifes Cricket sim and a sim from government subsity called assistwireless which is on tmobil band
[General Topics] jazzdglass:
I'm begining to think this phone might be strictly cdma only. Although I seriously wish I was wrong. This is because with the app shortcut Master lite, I was able to access the Phone activity where I was able to select GSM only, WCDMA only, then toggled airplane mode for both and still no service. I did manual network search and it returns an error. I tried automatic and it went on and on searching but always ends giving errors too. If this phone had gsm bands its supposed to pick signal here... I saw the activity VerizonHidden messages, but this didn't open saying I don't have permission bla bla... Maybe you could try the app.
[General Topics] Astr4y4L:
Is from the playstore ?
[General Topics] jazzdglass:
Yea. Use this instead

https://play.google.com/store/apps/details?id=com.sika524.android.quickshortcut
[General Topics] jazzdglass:
I finally made it into the hidden menu... I used this apk and the code through terminal emulator which can all be found here

https://xdaforums.com/verizon-lg-g3/general/mod-unlock-verizon-hidden-menu-t2822925

But whenever I click the GSM network it force closes saying unfortunately has stopped bla bla bla... Annoying isn't it?

Perhaps there is another version of hiddenmenu? Also there is still verizon hidden menu app deep in the framework I still can't open but saw it through shortcut Master app.. So I'm still hopeful
[General Topics] Astr4y4L:
Have u tried sqlite editor? If u know the location of the functions u r after open the database with editor and manually change values....

Works for me...