yashsingh1/xdaforums huggingface dataset:
[LG G5 Guides, News, & Discussion] adds08:
Dissembling and recoding aboot wont work no matter even if it is not encrypted..

It is already mentioned above by [MENTION=1157052]thecubed[/MENTION] ..

The secure boot will always verify the signature and dissassembly will generate no signature.

We need to find the private keys used for generating the public hash.. but that is not possible unless leaked from lg which is also very unlikely..

What a hacker can do is find a bug/vulnerability in aboot that can bypass secureboot..or a hardware loophole..

Plus there is a trustzone that itself secures the secureboot process.. so we have to find ways to exploit the bootchain so that we can somehow make the bootloader load unsigned ramdisks/recovery and such..

experienced people could do it.. but i guess there has been a lot of fuss between devs and wannabees..

Also if we can get debug build of aboot/ramdisk we can flash them to get unlock or at the very least root..

I am not expert on this but that how its simply put
[LG G5 Guides, News, & Discussion] LupineDream:
A brave member sent me a very useful PDF specification on the TSF. The TSF is the official name for the portion of the integrated circuitry that controls the storage of the secure boot chain. The hardware routines are there to allow root to happen, but as stated before by [MENTION=1157052]thecubed[/MENTION], LG commented out the entire section of a boot at compile time that allows anything to occur. Now the approach is to disassemble HOW the code that LG commented out works in the international variant that has an OEM unlock. Hardware routines exist that place the TSF into non-commercial mode, disabling functionality of certain enterprise software and deauth-ing the root CA in qfuse, allowing the user to flash their own signing certificates to the TSF (TrustZone) when a request to switch off CC mode is sent. There are all kinds of virtual memory protections, ACE protections, malicious code protections, and other things that the TSF handles. Trying any kind of unauthorised write to protected areas of memory results in blow of qfuse write fuse. It's actually a physical microscopic fuse that when pushed a specific voltage pops at a microscopic level kind of like a big fuse blowing only at a very tiny level. At this point write access anywhere is gone. This happens at the same time a full wipe of the system happens. That is why they say once qfuse blows your phone becomes a very expensive cup holder. Because after the qfuse blows there is no way of software recovery.

The only way to be able to disable commercial (CC mode) and be allowed to do anything to put your own boot chain in is to place the device in debug mode. The international varient contains code how to accomplish this, our devices don't. You would need to compile an app that runs in normal mode, causes a flag to be set that places the device into debug mode, then reboot. While in debug boot, you should be able to execute a CC unlock manually. The PDF I got says it's very specifically timed when this can happen, what parts of boot the TSF allows it to happen, and a rough explanation if what disabling CC mode means. The only way of getting root is to use the TSF-approved method but all this code is removed. The TSF does not stop you from executing code if booted into factory debug mode. The new approach I propose is to find an exploit to get into userdebug, and manually write an unlock routine with disassembled information from the international varient., pushing it directly into execution memory while in userdebug, being absolutely sure to give the TSF what it asks for, when it asks for it, at the exact timing for it.
[LG G5 Guides, News, & Discussion] nalf3in:
Thanks for that post [MENTION=2924897]LupineDream[/MENTION] ! I unfortunately doesn't understand most of the things you explained but perhaps I can save you a bit of time (your last post looks like you aren't aware of that exploit but thats maybe only me misundertanding) ; as far as I know the adb root method develloped by [MENTION=8032982]Honestly[/MENTION]Annoying include a userdebug kernel so (afaik) we already know an exploit to get into userdebug on marshmallow(dirty santa) and the fact that the users needs to run marshmallow shouldn't matter as (afaik) once the bootloader unlocked, the userdebug kernel is no longer needed and it is possible to change it.

Edit: just saw your post on the adb root thread, so I guess you are now aware of the exploit :P Sorry for the post, I just wanted to be sure you didn't missed it.
[LG G5 Guides, News, & Discussion] LupineDream:
Yes thank you for affirming that, but not to worry, I got it. LG has an sbl module called anti-rollback that prevents flashing older software. If we look at the boot chain:

recovery
| /------------------ laf (fastboot)
__________________|__|_________________________________________ laf (security fail screen)
/ / / /
pbl -> sbl > aboot > boot (kernel/ramdisk) > system
^ ^
| |
| \-- IS_UNLOCKED and sig_Check()
Anti-rollback

I beleive anti-rollback was updated to a new version that prevents this on Nugout. Correct me if I'm wrong. I've tried every LG hidden menu code I could find to see, but can't even seem to get the hidden menu working... And the reason they did this is because of the worldwide alerts about dirtycow, which affects not only Android, but the whole of Linux, so we need a nogout kernel. A marshmallow kernel with the new anti-rollback would theoretically end up in the red triangle of death.

We need someone that has an engineering model with a userdebug kernel. LG makes you apply. Their program is called "LG GATE", and they are very picky. I think that's what helped out the Sprint community. Someone got a hold of a developer / engineering model with a marshmallow kernel.
[LG G5 Guides, News, & Discussion] nalf3in:
Well, I already heard of that strange issue with the hidden menu and I always though it was a code 18 but after googling, it looks like it some carrier potentially disabled it.. Anyway, I can confirm you that the anti-rollback version is still 0 on my h831 running the latest nougat unless the hidden menu is "lying". (And most variant I know except sprint, which did triggered the counter with the update, stayed at their rollback version). I still encounter the same issues most people on nougat experienced with the adb root (wasn't able to get past reboot and needed to flash with uppercut a fresh 7.0 ) so I guess the issue is somewhere else.

Also, if you need any information that is on the hidden menu, feel free to ask me :)

[IMG="hiddenmenu"]http://m.imgur.com/gallery/fTwgSUF[/IMG]

http://m.imgur.com/gallery/fTwgSUF
[LG G5 Guides, News, & Discussion] zmankiller:
Very exciting, gl
[LG G5 Guides, News, & Discussion] moksjm:
finally they are working on it
[LG G5 Guides, News, & Discussion] cloud1250000:
What about this line in the aboot.bin

(from canadian aboot)

LOAD:0F960100 aBootVerificati DCB " : boot verification skip ",0xA,0

Is there any way to disable boot verification? no need to go with full bootloader unlock.. if it's possible to just disable boot verification, right?
[LG G5 Guides, News, & Discussion] nalf3in:
To people who keep asking "is my phone compatible" in any thread with "root" or "unlock" in the title.

Have you even read the op ? There is NO UNLOCK at the moment for ANY variant other than the h850 and h830.I don't know about your h850 specifically but you should ask this information in the official booloader unlock for the h850. Once there is another way to unlock the g5, believe me, you won't be able to miss it : the thread will litterally explode. In the meantime, please stop asking "is that unlock compatible with my phone" and please READ what other posters already asked. If you did, you would have saw that [MENTION=2924897]LupineDream[/MENTION] said that he will TRY (not dedicate his life to it, he do it for free) to port the unlock to others variants once he is done with is own.
[LG G5 Guides, News, & Discussion] hugoinfante83:
ADB ROOT Install SU files

Hi All,

I have an 987 with a rom with root access from the ADB but is not root from the Android platform.

What steps I need to do to root the device using the ADB Shell.

Thanks
[LG G5 Guides, News, & Discussion] TwoPointZero:
With a bit of googling, I found this document (archived at mirror) "Notes about Qualcomm Secure Boot and Motorola High Assurance Boot (hab)"[1], possibly written by XDA member @tal.aloni

which is a condensed summary of knowledge about how Qualcomm devices validate the chain of trust.

Last modified February 23, 2017, 6:54:08 PM

It's not actually super secret info, I reckon a lot of this data is scattered but available on various topics in XDA and elsewhere. (the most interesting ones here being the "Verizon Galaxy SIII" and "QDL, EHostDL and DIAG interfaces" R&D threads)

So, PBL attempts to load the SBL images from emmc. Each image is broken into parts and processed using hash functions like SHA-256.

The resulting value is included in the image header along with a bundled certificate chain e.g.

"My OEM" (leaf cert) -> QUALCOMM Attestation CA (intermediate) -> QCT Root CA 1 (root)

The leaf cert has specially formatted "organizational unit" (OU) values in the X.509 Subject property, so that bootloader from vendor "A" cannot be used for a device of vendor "B".

The computed hashed value is signed using a private (ergo, non-public) key matching the certificate.

Now, quoty f.t.a. (emphasis mine):

* sha256 fingerprint

All mentions of this OEM_PK_HASH seem to suggest it is written in the qfuses during the production stage.

I suggest you read the series of, albeit very high-level, articles at http://bits-please.blogspot.com/ published mid-2016. They cover how the TrustZone BSP can be exploited. On the off-chance you manage to tamper those theorically read-only fuses, who knows...

[1] http://vm1.duckdns.org/Public/Qualcomm-Secure-Boot/Qualcomm-Secure-Boot.htm
[LG G5 Guides, News, & Discussion] abol_fa:
Too bad we don't have devs anymore

Sent from my sh!tty LG-H860 that is beyond crap
[LG G5 Guides, News, & Discussion] sal82:
i know this is in the early stages. but i wanna give you the files needed for the canadian model. maybe there could be something in there that would help.

so how do i get access and which files do you need?
[LG G5 Guides, News, & Discussion] SenhaiWu:
Hello there! Did the crack work continue?
[LG G5 Guides, News, & Discussion] sayyro:
I'm seriously shocked !!! I completely lost hope finding a root & costum rooms for the LG G5 (VS987)

Now I see a tiny hole of hope right there I'm surprised guys I hope this works ASAP, Subscribing to this post, Thank you much guys, waiting patiently.
[LG G5 Guides, News, & Discussion] wolfu11:
I lost hope on my vs987 too and recently bought the rs988 works great rooted on Verizon. I have a Moto z Droid and just got a soak test invite for 7.1.1. I gave my kid my turbo 2 after trying forever to root. Feels like the Z will be in the same boat unfortunately.
[LG G5 Guides, News, & Discussion] sayyro:
For the next 2 years it will be the only phone I have, I bought it a week ago so, I can't buy another one, that's why I'm waiting for the root patiently I hope they make it, because I have an unlocked vs987 and I can't use the hotspot thether it tells me that I should use a verizon SIM card, I'm not living in the us so .. I'm kinda trapped, the only solution would be a root to fix this and to be able to upgrade to the nougat also to remove those annoying bloatwares

For the next 2 years it will be the only phone I have, I bought it a week ago so, I can't buy another one, that's why I'm waiting for the root patiently I hope they make it, because I have an unlocked vs987 and I can't use the hotspot thether it tells me that I should use a verizon SIM card, I'm not living in the us so .. I'm kinda trapped, the only solution would be a root to fix this and to be able to upgrade to the nougat also to remove those annoying bloatwares
[LG G5 Guides, News, & Discussion] charrua123:
I hope the root patient for the LG G5 VS987 to remove the hotspot lock and the MLT TEST
[LG G5 Guides, News, & Discussion] WalterSilverio:
Try this: https://xdaforums.com/verizon-lg-g5/how-to/how-to-activate-hotspot-lg-g5-vs987-t3610819

I do not know which Android version you have installed but in 7.0 with the security updates it has been tested and works perfectly, it has not been tested with previous versions.
[LG G5 Guides, News, & Discussion] sayyro:
Marshmallow

Mine is marshmallow and I can't update it because I'm not living in the US I don't have a Verizon SIM card , that's why I need root for my vs987
[LG G5 Guides, News, & Discussion] sayyro:
I'm still waiting with tons of hope !!¡!
[LG G5 Guides, News, & Discussion] sayyro:
Thank you I've tried this method before even posting in this thread, it's not working sadly, I'm on marshmallow stuck for ever , I hope they find away to root it
[LG G5 Guides, News, & Discussion] charrua123:
I worked perfect on my phone LG G5 VS987 android 7.0 version VS98728B 01/05/2017

Try this: https://xdaforums.com/ver...vs987-t3610819

---------- Post added at 10:58 PM ---------- Previous post was at 10:52 PM ----------

Remove your sim card and check for system updates. I worked

---------- Post added at 11:00 PM ---------- Previous post was at 10:58 PM ----------

Remove your sim card and check for system updates. I worked
[LG G5 Guides, News, & Discussion] Ascii3:
Perhaps the LG G5 VS987 can be crossflashed to the LG G5 RS988.

I have never tried doing such a thing on an Android device, but I would think it should be doable. Unlocking the bootloader might not be necessary.

I have noticed that the following LG G5 variants have the same FCC ID of ZNFVS987:

VS987 - Verizon Wireless variant
US992 - U.S. Cellular variant
RS988 - General North America variant

Further, this is supported by the RF Exposure Info 1 report provided to FCC: https://fccid.io/ZNFVS987/RF-Exposure-Info/RF-Exposure-Info-1-2930307

Presumably, the variants are of the same hardware, but have different firmware.

What exactly should be flashed, or repartitioned, I am unsure.
[LG G5 Guides, News, & Discussion] sayyro:
You are a legend sir !!!

Thank you much I got many updates I did all of them , what left is the nougat [emoji173] thank you , would this method work on all phones? Or is it just a glitch on LG phones?

---------- Post added at 09:35 PM ---------- Previous post was at 09:34 PM ----------

What left is the Hotspot problem that needs Verizon Sim card , so there will be no need to wait for root or something ..
[LG G5 Guides, News, & Discussion] charrua123:
When you remove the sim card, you avoid verizon sim card check, that allows the updates.

In other models would have to prove
[LG G5 Guides, News, & Discussion] user 7:
Hi there

I have been following this thread and almost all vs987 unlock threads for a long time. Although i am not much of a dev myself , i have been going through a few hidden menus on the device .

Recently i found a download option in the service test menu.

I am not sure how relevant this is..., might be completely stupid but wanted to inform thats all..
[MENTION=1157052]thecubed[/MENTION] could you throw some light on this?

Thx

https://drive.google.com/file/d/0B2lQOjc_QOygOGU4d252VTB3NzQ/view?usp=drivesdk

https://drive.google.com/file/d/0B2lQOjc_QOygVnhGejVqZUY1WEE/view?usp=drivesdk

https://drive.google.com/file/d/0B2lQOjc_QOygN3VfVmJXcVVNcFU/view?usp=drivesdk
[LG G5 Guides, News, & Discussion] charrua123:
What are the codes that you use
[LG G5 Guides, News, & Discussion] user 7:
I didn't use any codes.

Used shortcut master lite from playstore to get into service menu and then launched the download menu
[LG G5 Guides, News, & Discussion] charrua123:
New update for LG VS987 ( VS98729A)
[LG G5 Guides, News, & Discussion] ganaa_sb:
my phone updated LG VS987 (VS9872AA)

---------- Post added at 04:45 PM ---------- Previous post was at 04:42 PM ----------

hi LupineDream my LG G5 VS987 text menu disabled how to enable ? i can't ping mobile signal
[LG G5 Guides, News, & Discussion] TheMadScientist:
Is this still a thing or dust in the wind?
[LG G5 Guides, News, & Discussion] LupineDream:
Its pretty much been abandoned. Reason being is I received some documentation on the phone itself. Its hardware-backed to prevent rooting, the Verizon variant. I wasn't going to risk a contracted daily-driver over a root method. Boils down to TrustZone key exchanges, and developer phones having a specifically different hardware configuration that allows root. Its been locked by LGE electronics signing certificates contracted to Verizon for use in consumer models. I attempted both dirtysanta and dirtycow on this model, which have made success for Sprint variants of the G5 that don't have the extra hardware protection. I've been told its possible, but a laymen will not take a soldering iron and go jumping traces so their UID, GID will stay at 0. TrustZone is hardware-based. On consumer-grade models, this hardware chipset prevents anything from being able to execute as UID=0. If something is discovered running as UID 0 (root), its process is killed by the TrustZone chipset unless the proper matching key is given, in turn which then by TOE regulations a factory reset must happen (Internal Storage Wipe).

tl;dr its a security chip that blocks root on consumer devices. :/ Constantly monitoring, and constantly aware of the process execution user on the system...
[LG G5 Guides, News, & Discussion] TheMadScientist:
Makes perfect sense. I figured. Long time g series owner. g2 2 g3s g4 and 2 g5s. Plus many more and same story on all of em.
[LG G5 Guides, News, & Discussion] greengold30:
please show me someone by video(maybe on youtube)
[LG G5 Guides, News, & Discussion] TheMadScientist:
There is no way to unlock the bootloader or unsign it. If you want root or roms my suggestion is to buy a different device if you want G5 rs988 or internati version...

If this give you any idea the LG G4 is still waiting for unlocks so people can root there so do not hold your breath as this is not happening any time soon..

There are to many issues with the device for dev to waste there valuable time on it, And personally I cant blame them.....
[LG G5 Guides, News, & Discussion] Newbiebob:
Could someone presumably attain a qualcomm chip that hasn't been programmed , or a viable e fuse chip that's compatible with the board from another device, or even a qualcomm chip from an international version of the g5 that wouldn't have the fuse for forced boot security and replace the stock 987 chip with it? I know, I know, I could "presumably" walk out my back door and find a unicorn, it's just practically impossible. I'm asking hypothetically, although chips from practically any device can be sourced with some patience. I highly doubt I could ever get ahold of a chip with all it's fuses intact to program, but maybe there's a workaround?
[LG G5 Guides, News, & Discussion] greengold30:
Thanks for your answer
[LG G5 Guides, News, & Discussion] LupineDream:
[MENTION=5759239]TheMadScientist[/MENTION] G2 ended up being possible via Loki. I thought dirtystanta would have worked until I saw that it was running UID=1000 (regular user), when I ran the script in the thread. G2 had its certs leaked, it was possible to "soft-patch" via some ingenious Loki magic.

Seems like LG got smarter making sure bytecode for TrustZone was intact. Loki was just able to JMP and MOV a few things around. Hence its trickster name. TrustZone never cared, it checked once then left it alone. Now it does. Thanks Verizon...

I blame the carrier as this is specific to the model. Some marshmallow users had partial success (thread's shut tight now because n00bs can't read). But on Verizon Antirollback is 0x1, not 0x0. So no getting to Marshmallow, a Nougut method is required.

TrustZone boot actually requires a callback from the chipset itself now, saying 'OK' to the boot image to be simple about it. Happens on the LG logo screen before the Verizon boot animation.

If booting happens without 'OK' from that memory area, hault and bye-bye internal storage.

You can mess with the loader all you like on your next reboot red triangle of death and hunting down KDZ files.

Verizon really doesn't like us messing with their phones it seems. Our bill's sky high too, so I haven't the best opinion of them.

I still use this phone as DD as of now. Not repeating the contract phone offense. Buy an open phone if you want all the cool mods, kids. BYOP SIMs are 19.99 to ship if you ask nicely. That's what this is boiling down to.

You can close this thread. The phone's most definitely EOL now (or will be soon, surprised it still gets security patches).
[LG G5 Guides, News, & Discussion] TheMadScientist:
Well said well said. I have been studying lg bootloaders since the g2. I have owned g2-g5. And also many lgs in between. Since nougat. The trust zone checks all boot system and everything in between. Thats why bootloader unlock required before root now.

It will be unlockable one day. Probly quite easily once it comes down go it.

And I have personal hope that we will all see oreo on our devices as it had only seen 1 major update. Look back at some of the samsungs notes. If u had a certain uid on a type of memory u could root it.

Al found last years from wHt i have read.

Never lose hope but never base buying a device on hopes either....
[LG G5 Guides, News, & Discussion] Craz Basics:
Since this thread seems dead; Anyone try just rooting?

Would it be possible to use adb to push systemless root, like on the QC s7 and s7 edge?

Only thing would we would need system write protection off, like the ENG boot.img does, as it doesn't have dm-verity.

I'd be happy to help, though I do not have the phone
[LG G5 Guides, News, & Discussion] Honestly Annoying:
no
[LG G5 Guides, News, & Discussion] Craz Basics:
That was helpful
[LG G5 Guides, News, & Discussion] Honestly Annoying:
it just sucks to see people "coming up" with ideas that we had over a year ago. do some research, everything that has been tried has already been laid out step by step.
[LG G5 Guides, News, & Discussion] charrua123:
Check this, Verizon certificate extraction.

http://www.mediafire.com/file/c47dk...+Llc+Service+Tool++v6.6.9++Uploade+By+TMF.rar
[LG G5 Guides, News, & Discussion] bayr691@gmail.com:
LG G5 h850 qfil files leaked somewhere now. So cant we unlock bootloader using that. Especcially converting device into bootloader unlockable like G4.
[LG G5 Guides, News, & Discussion] Vicious942:
Anything new on development? I have a VS987 with Nougat.
[LG G5 Guides, News, & Discussion] Sultan009:
Did you finally able to unlock the bootloader?

If so how did u do the miracle?
[Nexus 5X Q&A, Help & Troubleshooting] harkan91:
Hello guys, i have a problem with my nexus 5X: the type-c port doesn't work anymore for pc transfers (i tried with 3 different cables and 2 PCs), i guess that only the data rail is gone because the charging still works.

My problem is that i don't have the stock rom and i need it to send it back for warranty so i'd like to ask if someone can give me a link to flash the stock rom (and recovery!!) to flash everything through twrp and if it is possible.

Thanks, Luca
[Nexus 5X Q&A, Help & Troubleshooting] SlimSnoopOS:
What you're asking for only exists in one place.

https://developers.google.com/android/images

Your main option is to download the latest factory image. Unzip the archive so that you have the system, boot, and vendor images available. Boot into TWRP 3.0+ and do a factory reset then select Install/Install image to flash those three images individually. Bootloader and radio cannot be installed in this manner.

Your alternative is to use the Google stock Full OTA images:

https://developers.google.com/android/ota

Then use Flashfire to install this image:

https://xdaforums.com/general/paid-software/flashfire-t3075433
[Nexus 5X Q&A, Help & Troubleshooting] harkan91:
thanks for you comment: i didn't know that i can flash stock rom too through twrp recovery

if i install flashfire i would be able to flash the recovery?
[Nexus 5X Q&A, Help & Troubleshooting] SlimSnoopOS:
Yes it can. Btw, stock recovery will replace TWRP on reboot if you flash Nougat images for boot, system, and vendor in TWRP.