yashsingh1/xdaforums huggingface dataset:
[T-Mobile LG G6 Guides, News, & Discussion] Honestly Annoying:
we have all just been busy in real life, development has not been stopped! sorry for the lack of communication
[T-Mobile LG G6 Guides, News, & Discussion] pantmunu:
Thank you for your response. I have hopes. And hopefully we will have a method to root this beauty sooner. I am no dev but pls do consider pming me if you need any assistance or a tester. Thank you.
[T-Mobile LG G6 Guides, News, & Discussion] xionide:
Hey yay yay yay,

Checkin this thread erry'day.
[T-Mobile LG G6 Guides, News, & Discussion] brossovitch:
Still hoping something breaks for us.

But I'm joining the online panel from LG to allow them to take diagnostics from mt G6 to try and better the experience.

Basically free money.
[T-Mobile LG G6 Guides, News, & Discussion] GrippenTech:
Honestly if one of u guys could at least post what u've found so others could try to work off that it would be great...
[T-Mobile LG G6 Guides, News, & Discussion] Yazuken1:
I've come up with an idea... There is a whole set of firmware for the H872 (yes.. LG G6 H872.. specific model) from a carrier other than T-mobile. The carrier is called ClaroPR (It is a carrier in Puerto Rico).. I am wondering if I try to flash ClaroPR's firmware onto my G6 if it would be compatible, flash and boot perfectly, and potentially even be rootable. The problem is this.. I'm having trouble getting my hands on the firmware... If anyone has an LG G6 from the carrier ClaroPR, please let me know in a PM.
[T-Mobile LG G6 Guides, News, & Discussion] brossovitch:
You can download the source code and compile it.. But I'm sure it's not quite that simple..
[T-Mobile LG G6 Guides, News, & Discussion] christopherrrg:
How would you gain root from flashing another OEM software?
[T-Mobile LG G6 Guides, News, & Discussion] joedeuce:
I guess his thinking is that fastboot may not be crippled with that aboot, and that an unlocked bootloader would survive the update.

I do know it isn't possible to roll back to previous t-mobile builds, so i wonder if the anti-rollback wouldn't be a roadblock.

Looking at LGs source, it looks like the H872PR is still on 10a.
[T-Mobile LG G6 Guides, News, & Discussion] rootmirror:
Any luck?

Would you be able to you give us an update on whether or not this worked? Finger's crossed.
[T-Mobile LG G6 Guides, News, & Discussion] Yazuken1:
I'm not sure how to compile the H872PR firmware. So none yet... It would be really helpful to have one already compiled. I would be willing to attempt flashing it to my phone to test if it is rootable.
[T-Mobile LG G6 Guides, News, & Discussion] rootmirror:
All I could find...

https://xdaforums.com/lg-g6/how-to/list-lg-g6-stock-firmware-t3583763

He has a lot of variants up there including the Canadian 873 but no 872pr so you might want to contact him about it..
[T-Mobile LG G6 Guides, News, & Discussion] Barsky:
Has anyone simply flashed the stock kdz (H87210o_00_0630.kdz in this case) with lgup and uppercut, to return it to complete factory stock? Is it safe? I've done it numerous times on my previous LG G5, but not with the LG G6.
[T-Mobile LG G6 Guides, News, & Discussion] Hex-US:
Only works if, it's a signed .kdz, with the G5 or older LGUP you could flash an unsigned G5; something like that I believe.
[T-Mobile LG G6 Guides, News, & Discussion] Barsky:
I got it here: https://lg-firmwares.com/lg-h872bk-firmwares/

Not sure if they are signed or not. Would a unsigned brick the phone, or simply not flash?

Thanks for the reply.
[T-Mobile LG G6 Guides, News, & Discussion] Hex-US:
Never been to this site, looks promising! I can't test to flash it at because I'm on vacation and not at my personal PC :(. However, if it's an unsigned .kdz it refused to flash it on LGUP I believe. Thanks for showing me this though!
[T-Mobile LG G6 Guides, News, & Discussion] Barsky:
OK. Sounds good. Thanks
[T-Mobile LG G6 Guides, News, & Discussion] joedeuce:
Using the modified LGUP from https://xdaforums.com/lg-g5/how-to/unlocking-lgup-features-fun-profit-t3634650 it seems like it is flashing individual partitions, but flashing the system.img takes a lot less time than it should, leading me to question it... It is definitely doing something though because I can flash the system from 10e and it hangs at LG startup screen; re-flashing system partition from 10o still leads to being stuck at LG screen.

On to recovery partition... Even if it flashes TWRP image, it is being overwritten on system startup. I know of no way to get to recovery other than adb.

I'm pretty sure download mode comes from aboot, but I want to be absolutely sure before I mess with boot image.

Since there is no "open" root development, I figured i would post what I've been able to come up with. There's no reason we can't root, other than my lack of knowledge. If LGUP isn't actually flashing the individual partitions, it shouldn't take much effort from someone that knows what to do.
[T-Mobile LG G6 Guides, News, & Discussion] cdudeman:
thanks for your work man. Hopefully this will lead someone knowledgeable down the correct path. I for one cannot wait until we can unlock the full potential of this phone!
[T-Mobile LG G6 Guides, News, & Discussion] jamesd1085:
You said it is overwriting recovery on boot...have you tried flashing recovery image and then instead of rebooting to use the button combo to boot directly into recovery?
[T-Mobile LG G6 Guides, News, & Discussion] pantmunu:
What I remember form.other devices is that after you flash recovery, you have to boot back into recover asap for the stock recovery to not overwrite twrp .. correct me if I'm wrong ..
[T-Mobile LG G6 Guides, News, & Discussion] joedeuce:
The only way I've been able to get to recovery is by using 'adb reboot recovery'. Seems LG took the button combo from us, or I could be doing it wrong.

Correct, /system/recovery-from-boot.p has to be removed or renamed.
[T-Mobile LG G6 Guides, News, & Discussion] pantmunu:
Interesting. Will we be able to door that with the extracted system.img .. or anything. First lg device, so idk how anything works. Also doesn't LG release eng kernels or firmwares for developers like Samsung does.
[T-Mobile LG G6 Guides, News, & Discussion] joedeuce:
Not sure.

My next idea is to flash twrp, then immediately reboot to download mode and get a dump of recovery partition to see if it is actually flashing.

---------- Post added at 06:34 PM ---------- Previous post was at 06:05 PM ----------

The recovery partition is zeroed out after flashing twrp and getting a dump of it.

This may explain why others were searching for the elusive LGUP version 1.9
[T-Mobile LG G6 Guides, News, & Discussion] joedeuce:
Next plan is to use wireshark to see if I can gain any clues as to why it is zeroing it out... maybe some type of signature check? If I flash stock recovery over the zeroed out recovery, a dump shows that it gets written.
[T-Mobile LG G6 Guides, News, & Discussion] pantmunu:
Keep up the good work my friend. Let me know if u need anything.
[T-Mobile LG G6 Guides, News, & Discussion] anon1ski:
This is getting interesting.
[T-Mobile LG G6 Guides, News, & Discussion] pantmunu:
[MENTION=836059]joedeuce[/MENTION] sorry to bother you sir, but have you found anything yet ...
[T-Mobile LG G6 Guides, News, & Discussion] joedeuce:
Not really.

It seems that the LAF WRTE command isn't working in LGUP. I captured the traffic to and from the phone via wireshark while attempting to flash recovery partition; it appears the authentication is good, and the recovery image is being sent to the phone... Its just not being written.

My next plan is to see what happens when i flash an entire kdz with LGUP... I know it does write to the phone, so maybe the captured traffic will give clues as to why individual partitions won't flash.
[T-Mobile LG G6 Guides, News, & Discussion] nima0003:
In case you didn't know, the LG recovery combo is diffirent, hold the power button and volume down button, and as soon as LG logo appears, keep holding volume down but let go and repress power.
[T-Mobile LG G6 Guides, News, & Discussion] ph0tiC:
I swear to god this is the same thing that went through my head. I Got this phone to replace my Nexus 6 (RIP, good friend) after a quick search of unlocked bootloader. Boy did i get screwed.

After reading everything going on, sniffing traffic via wireshark seemed like the right way to go.

- Bootloader commands dont work, but some mysterious LG bridge LGUP stuff does? what'd they do, add "ie" to the commands to obfuscate? hmmmmmmm....

I dont know much about development, and at this point im so pissed off with LG that i dont care if i break my phone. what can i do to help or break it?
[T-Mobile LG G6 Guides, News, & Discussion] RicardoSal24:
Can you PM me how you're doing it?
[T-Mobile LG G6 Guides, News, & Discussion] Honestly Annoying:
i can create a system.img with "/system/recovery-from-boot.p" removed.
[T-Mobile LG G6 Guides, News, & Discussion] joedeuce:
All the info I have is here, but yes, i can sum it up but it will be tomorrow evening. Gotta work all night.

That may be useful, but I now know the LG way to boot to recovery. If we can just find a way for recovery to write...

All my work on it is at home, I've still yet to look at the packets sent when it actually writes to a partition.

I'm fairly certain we can get TWRP written using the lglaf Python script.
[T-Mobile LG G6 Guides, News, & Discussion] Hex-US:
Dude, for all your work I don't mind donating to you for helping all of us. Thank you, so much. Put the PayPal info, or whatever you accept and I'll donate to you my man.
[T-Mobile LG G6 Guides, News, & Discussion] joedeuce:
No need yet... I don't want to disappoint if i can't get it. Donations are appreciated though -- it helps me convince my wife to let me work on it more ? https://www.paypal.me/JoeLangston is the link.
[T-Mobile LG G6 Guides, News, & Discussion] RicardoSal24:
After the recovery writes, try to go to to recovery. Try not to let it boot completely though. If its anything like the US997, after flashing twrp through fastboot, we had to go to recovery using button combination, and if the phone booted all the way through, recovery would not write and had to flash twrp again
[T-Mobile LG G6 Guides, News, & Discussion] joedeuce:
The recovery doesn't write... It erases it, but doesn't write to it.

I thought i almost had it using the aboot from the US997... It attempts to write it, but the progress indicator on the phone freezes at 99%... It then boots straight to download mode (it won't boot system at this point), but the fastboot commands still don't work in fastboot mode so I doubt it is writing aboot. After that, I flashed the 10p kdz trying to restore it, but it failed to boot... It would start then go to a blue screen with a big number "2" in the middle of the screen and at the top it said "encryption successful" (I'll get pics if this happens again).

After several reboots, it finally booted system and all seems normal again. Thought i had a brick.

I may very well end up with one.
[T-Mobile LG G6 Guides, News, & Discussion] Hex-US:
Did you modify the LGUP software? If you didn't you should try, Honestly Annoying on the thread here did, if you guys can break through on that; that would be amazing. I wish he were more active, but I think that is a way if doing this.
[T-Mobile LG G6 Guides, News, & Discussion] joedeuce:
Yes, used the modifications from the "hacking LGUP for fun and profit" thread.
[T-Mobile LG G6 Guides, News, & Discussion] brossovitch:
Thank you for your work. LG doesn't seem to want this device rooted. Maybe when the Oreo update comes they'll forget to block fastboot again? Haha.
[T-Mobile LG G6 Guides, News, & Discussion] joedeuce:
Doing some research it seems the blue screen is well known in LG land.
[T-Mobile LG G6 Guides, News, & Discussion] mjdavis871:
This sounds encouraging. https://xdaforums.com/showthread.php?t=3473445
[T-Mobile LG G6 Guides, News, & Discussion] joedeuce:
Still requires us being able to flash the patched boot image
[T-Mobile LG G6 Guides, News, & Discussion] mjdavis871:
I'm hopeful...says it can flash without root, just need an unlocked bootloader...of course ours is a little crippled
[T-Mobile LG G6 Guides, News, & Discussion] letrain02:
I'm sure it's come up..but just curious has anyone tried zero out the laf partition and see if fasboot comes up like older devices?
[T-Mobile LG G6 Guides, News, & Discussion] johndc7:
You have to have the boot.img for that to work. Should be able to extract from the kdz or something. If anyone can tell me where to find it then i can try it out and see what happens.

Edit: I just looked through the magisk thread a bit more and it looks like you need to be able to flash a boot.img or something through fastboot. That command is one of the many that was removed from this device. That did seem too easy for that to be our way to finally get root. Hopefully i'm wrong though.
[T-Mobile LG G6 Guides, News, & Discussion] sumaru:
I tried this yesterday and it seems to me that Magisk needs a flashable zip instead of a kdz. The zip needs to include the boot.img inside as well. I tried using LGExtract, LG-Utils and DZDecrypt to open up the kdz but I keep getting errors: 7zip says the cab from LGExtract is invalid, DZDecrypt says "Invalid markers in main header". LG-Utils simply crashes for me.

Perhaps if we can get a flashable zip of stock, use Magisk to patch, and then convert the zip back into a kdz, we can use Download mode to flash it?
[T-Mobile LG G6 Guides, News, & Discussion] letrain02:
There is a flashiable zip in the forums. As well as img files. Magisk does recognize boot.img and patches it accordingly. But the same issue we've been having. No fastboot commands to flash it. Don't bother trying to open a kdz there are already room dumps around if you want to play with those. With magisk we should have root easily... If we figure out how to flash img files. Or can get it wrapped back up in a kdz thats signed.
[T-Mobile LG G6 Guides, News, & Discussion] johndc7:
We won't be able to use any of the adb flash tools for magisk but maybe it's possible to flash the patched boot.img with lgup.
[T-Mobile LG G6 Guides, News, & Discussion] letrain02:
Magisk will patch it. Or at least it says it does. I'm just not home so no way to test if lgup will flash it. Plus I'm not on the build that was dumped. I'm on 10p. I believe it is 10h that's on the forums here. Magisk directions say to use app to patch it. Then it deposits it on storage. Then you need to flash in fastboot like we're all use to doing by moving file to PC. If we can flash boot.img don't see why we can't flash a patched image... It's basically injecting magisk without the need for custom recovery.
[T-Mobile LG G6 Guides, News, & Discussion] pantmunu:
This sounds very promising.
[T-Mobile LG G6 Guides, News, & Discussion] joedeuce:
Well, I'm 99% sure I bricked mine... it will only boot to fastboot now, and we all know you can't do anything with fastboot. I incorrectly assumed it would boot to the bootbak or lafbak partition(s) if need be. I tried flashing a boot image -- it only erased the partition, same as it was doing with recovery. Instead of flashing the kdz to restore boot image (like I should have done), I thought I would try zeroing out the laf partition just to see what happened.

My only hope now is to find a way to get it in qhsusb_bulk mode or take it apart and hope i can find some way of manually enabling so i can flash the partitions directly to the eMMC.
[T-Mobile LG G6 Guides, News, & Discussion] brossovitch:
Noooooo! That sucks!

No Download Mode either? Jeeze, TMO really screwed us this time..
[T-Mobile LG G6 Guides, News, & Discussion] joedeuce:
Yeah, no download mode. It boots to fastboot when you try to boot to download or when you try to boot to system. I can get to stock recovery, but wiping data is of no use ATM.
[T-Mobile LG G6 Guides, News, & Discussion] johndc7:
Can you flash anything without the laf partition? If you can try to flash twrp.
[T-Mobile LG G6 Guides, News, & Discussion] joedeuce:
No, I've tried fastboot flash, fastboot boot, and fastboot update... fastboot is all but useless. I'm pretty sure laf being zeroed out is why i can't get into download mode.
[T-Mobile LG G6 Guides, News, & Discussion] letrain02:
Can you push files to the phone? There is a way to push the laf image I believe. Wish I could find the info. Were you able to make a back up of laf?
[T-Mobile LG G6 Guides, News, & Discussion] joedeuce:
Yes, I have all partitions backed up. A way to write the laf image or boot image would be very welcome. ?
[T-Mobile LG G6 Guides, News, & Discussion] treezy26:
Just wanted to give props on all your efforts. I wish I knew where to even begin looking to pull something like this off. My hats off to you. :good:
[T-Mobile LG G6 Guides, News, & Discussion] joedeuce:
Pretty sure it's going to take an exploit to something running privileged... and the privilege escalation exploits are few and far these days.
[T-Mobile LG G6 Guides, News, & Discussion] letrain02:
How did you make the backup? Was it will lgbridge? Or fastboot?
[T-Mobile LG G6 Guides, News, & Discussion] joedeuce:
Used a modified LGUP from https://xdaforums.com/lg-g5/how-to/unlocking-lgup-features-fun-profit-t3634650 to dump all partitions
[T-Mobile LG G6 Guides, News, & Discussion] denshigomi:
BlueBorne sounds like it might be promising as a privilege escalation exploit.
[T-Mobile LG G6 Guides, News, & Discussion] letrain02:
I tried fastboot flashing update.zip and it recognized the commands. I haven't had a chance to play much but is fastboot not recognizing commands or is it recognizing them but not executing what it says it doing. Like flashing a partition. I have seen directions some where about previous lg phones and flashing to the specific block where the partition is. Just like moving files from PC to phone on fastboot.
[T-Mobile LG G6 Guides, News, & Discussion] joedeuce:
It's returning "remote command failed" on 'update', 'flash', or 'boot'. It accepts the image (or zip in the case of 'update') but doesn't write anything.
[T-Mobile LG G6 Guides, News, & Discussion] letrain02:
so its "running the command" but actually doing nothing. wish there was a way to see what processes if any its actually running when it accepts your image, or zip, but does nothing...

Edit: have you tried putting the update.zip or any of the files on an sd card, insert the card, boot then try commands? using official lg files?
[T-Mobile LG G6 Guides, News, & Discussion] johndc7:
That's because all the commands are removed. It does the same thing on my phone.
[T-Mobile LG G6 Guides, News, & Discussion] i2andog:
LG-G6-TMO-H872-10e-Stock-Rooted.zip

https://www.androidfilehost.com/?fid=817550096634759622

MD5: bd88504b333ee7a30fca1d4052fbbccf

would it be possible to flash this rom via LGUP or something along those lines?? if so you may be able to use chainfires fireflash in lue of twrp basically circumventing the need for twrp. I did this with the lg g3 vigor bc there was not a custom recovery for that model.. just an idea..
[T-Mobile LG G6 Guides, News, & Discussion] brossovitch:
Unfortunately no. There's been discussion of this already. Sux
[T-Mobile LG G6 Guides, News, & Discussion] mingkee:
I think I may jump in GSM/CDMA unlocked version (US997) as root is possible.
[T-Mobile LG G6 Guides, News, & Discussion] Hex-US:
I'm returning this phone for an unlocked V30 when it hits the market.
[T-Mobile LG G6 Guides, News, & Discussion] runningnak3d:
Evening guys. I am currently working on the LAF protocol (download mode) to help the H918 V20 folks. Well, actually, it will help ALL V20 models. Besides this has anyone here been working with LAF? Before I continue on and find out that I have wasted my time, I figured I would ask. With an unlocked boot loader, aboot no longer does any verification on boot or recovery, so if LAF can be figured out, then a custom kernel, and TWRP could be flashed. It is download mode. It trusts what you tell it, so it will write what you want.

I am actually taking this a step further. I figured out that (at least on the V20 models that I checked), aboot still checks to see if it is unlocked even on phones that don't have the ability to do so. So phones that don't have fastboot, could flash a modified persistent and aboot will honor the unlock (I verified this on an H910).

So, if the new LAF protocol can be fully decrypted, then it would be possible to root any current LG phone. Again, unless there is something glaring that I am missing.

I came here because 1 - the work I am doing applies to you guys as well, and 2 - I need help from people that understand reverse engineering.

Sorry if this was a thread-jack :)

-- Brian
[T-Mobile LG G6 Guides, News, & Discussion] joedeuce:
I was unable to get much other than a little info from the H872 using the lglaf script.

Using the modified LGUP from the G5 forum I was able to send individual partitions to the phone, but they wouldn't write. Each time I would end up with a blank partition... I assume the erase command was being executed but for whatever reason (lack of signature maybe) the write command was failing.

I have USB traffic from lglaf and LGUP logged with Wireshark if it's something that will help you. I emailed logs to the creator of the lglaf script but haven't heard back.
[T-Mobile LG G6 Guides, News, & Discussion] runningnak3d:
I am most definitely collecting packet dumps. If you don't want to share them publicly, please PM me a link.

Yea, I gave up on hacking on LG UP when it dawned on me that it was easier to just write my own so I knew exactly what it was doing. Then I found the lglaf project, but it seemed fairly dead.

Hopefully we can pull some people together from all the LG forums since this would allow literally any LG phone to be rooted.

Pray they don't do something stupid like force OTA updates.
[T-Mobile LG G6 Guides, News, & Discussion] sumaru:
Sorry I am a bit of a newbie, but if you give me a brief instruction, I will do my best to help out with providing packet dumps or testing.
[T-Mobile LG G6 Guides, News, & Discussion] nima0003:
Don't waste your time, we have tried and tried and tried.
[T-Mobile LG G6 Guides, News, & Discussion] Hex-US:
He's kinda onto something, don't demote a person, you never know. Why don't you help us as a community, instead of complaint about this not going your way?
[T-Mobile LG G6 Guides, News, & Discussion] nima0003:
I never said it's not going my way ? and I'm not complaining either ? he literally asked if anybody else tried and if it would work and I told him we tried and it doesn't work am I supposed to lie to him?
[T-Mobile LG G6 Guides, News, & Discussion] runningnak3d:
On the V20 I have been able to dump and write full luns (sda, sdb, etc), but not individual partitions (sda1, sde4, etc). Unfortunately even if I use dd from an adb shell on a rooted device to dump a full LUN, I haven't figured out a way to loopback mount it so that it can be modified. losetup doesn't find any partitions... So dumping / writing full LUNs is useless -- need to be able to write individual partitions.

As for your thought on SIGN, if you look, it is the md5 of the partition being sent, and CHCK CLER is checksum clear. So yes, if you want to write, you need to send the md5 with SIGN, and when you are done, you need to clear the checksum.

I am not giving up, and any help would be welcome :)

EDIT: Also, INFO SPRO and INFO GPRO are get and set property. From what I have been able to tell, it is used for things like sending the device model / firmware version.

-- Brian
[T-Mobile LG G6 Guides, News, & Discussion] joedeuce:
Another interesting laf command i saw today was SBLU...
[T-Mobile LG G6 Guides, News, & Discussion] thjubeck:
Cool. I'm looking for the jcase backdoor so any ideas would be appreciated.
[T-Mobile LG G6 Guides, News, & Discussion] jamesd1085:
Could possibly talk to jcase directly...with many devices getting ready to recieve oreo he may not want to post exploit publicly in fear it will instantly be patched in the update...just my 2 cents