yashsingh1/xdaforums huggingface dataset:
[LG G6 Guides, News, & Discussion] MozezzFG:
When you try to brutforce them, generate a pssword list in linux. Use crunch command in console.

e.g. crunch 6 6 0123456789 -o handy.txt.

It means crunch generate a file with 6 chars -o pw.txt means e.g output pw.txt

It means crunch generate a text file with numbers from 000000,000001,000002 to 999999

generate one i`ve add a screenshot

View attachment 6026518

When finsih open your txt file with editor.

View attachment 6026520
[LG G6 Guides, News, & Discussion] francians:
I already posted a brute force method. But I fear it may take years to give a positive result
[LG G6 Guides, News, & Discussion] WojtekCC:
I think we should look for some exploit in android system (nougat? because its old?) or some hardware exploit (something like "mtk-su" exploit)?

Or find a way to do it with firehose files.

Because bruteforcing will take loooong time.
[LG G6 Guides, News, & Discussion] luridphantom:
here ya go https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-12753
[LG G6 Guides, News, & Discussion] francians:
Thanks for sharing!

Interesting idea, I am not sure it could work for G6 though...

I tried (with some little change to the script) to extract the images from: raw_resources.img (obtained from an OTA LG-H87010f-Flashable.Bootloader.zip).

The result is:

BOOT_IMAGE_RLE 0x22 0x1003 b'lucye_global_com' 3256092

0 0 0 0 0 0

0 0 0 0 0 0

[snip]

load_charger_image 8192 68980 1440 2880 0 0

downloadmode 77824 36312 475 140 482 1370

I think they changed the battery images and removed the "LGE_PM_NO_CHARGER" in favour of a single resource (load_charger_image). I fear flashing that image, if doesn't brick the phone, will trigger the payload anytime the charger plugged-in.. Not just to 0% as the original reporter did on it's phone.

I'm not an expert and cannot tell if you will be able to charge your phone outside of Android. But after the unlock is done you may want to flash the original bootloader and remove the payload anyway.

That said I don't care to use my phone as test subject but I may need some help to write the payload and flash it.
[LG G6 Guides, News, & Discussion] luridphantom:
you might wanna read his follow up: https://douevenknow.us/post/639414006930702336/tying-it-all-together-pwning-to-own-on-lg-phones

the idea is even better, theoretically you can weaponize lglaf to write a patched aboot that allows any boot image to be flashed: https://github.com/shinyquagsire23/Q710-SIGNhax-EL3-Warmboot

opened a thread earlier this year but not enough interest to dive deep into this: https://xdaforums.com/t/cve-2020-12753-lafsploit.4566711/

i think it was @steadfasterX who suggested it to me as a way of breaking open old lg phones, just havent had the time to check it out due to work stuff
[LG G6 Guides, News, & Discussion] ivanxhack132:
What would be the program and the procedure to unlock the bootloader?

Is there any risk in doing so?
[LG G6 Guides, News, & Discussion] francians:
The idea is to flash a custom bootloader part that can bypass the signature check and call the unlock process.

Of course must be evaluated if G6 is affected by this vulnerability, to write the payload and to test it on a real device to see it works.

The risks are the ones involved when you flash a device, brick it..
[LG G6 Guides, News, & Discussion] luridphantom:
it should be affected but the issue is finding the offsets needed to exploit the vulnerability. the author mentioned it varies from device to device but using his example with the stylo 4 can be a start if youre interested
[LG G6 Guides, News, & Discussion] ivanxhack132:
In that case I will risk my LG G4 Stylus

Do you have the link or a link to use the tool?

Would there be a difference depending on the type of hardware if I use the program?
[LG G6 Guides, News, & Discussion] luridphantom:
check the link i posted for github samples

and yes, you need to read thoroughly and find the offsets in the aboot to attempt a bl unlock. though the g4 stylus might be too old
[LG G6 Guides, News, & Discussion] Mohammad Jebreeni:
@francians Hey there pal! How are you? I hope you and the whole community are always well and safe,,

I'm very glad to see that someone is still trying to unlock the bootloaders of our beloved LG G6 devices that have yet to be unlocked bootloaders. Thank you a lot for that.

You asked about how to get the device ID, our friend here whose reply I quoted (@nach_0.0) showed how to get it in this photo. You should boot to fastboot mode by the way.

I tried that before and got the device ID simply. If you need any help with that please inform me.
[LG G6 Guides, News, & Discussion] francians:
I fear you missed the point that DeviceId is a sha256sum and not the "real" id, but just an hash of it.
[LG G6 Guides, News, & Discussion] Mohammad Jebreeni:
I see
[LG G6 Guides, News, & Discussion] luridphantom:
you guys are better off trying to exploit through lglaf than brute force an unlocking key
[LG G6 Guides, News, & Discussion] ze7zez:
Tested with:

https://github.com/Lekensteyn/lglaf

LG G3 (D855) on 64-bit Arch Linux (Python 3.5.1, pyusb 1.0.0b2, libusb 1.0.20)

LG G3 (D855) on 32-bit Windows XP (Python 3.4.4, LG drivers).

LG G2 (VS985).

LG G4 (VS986) on Linux (Python 3.5) and Windows.

LG K10 2017 (M250N) on Linux (Both Python 2.7.13 and Python 3.5.3).

Have you tried with the G6?
[LG G6 Guides, News, & Discussion] luridphantom:
check out the articles and GitHub link I posted earlier. guy managed to exploit his stylo 4 bl which is newer than the g6
[LG G6 Guides, News, & Discussion] luridphantom:
looks like the exploit finder is also on xda: https://xdaforums.com/t/lg-stylo-4-root.3816803/post-82034749
[LG G6 Guides, News, & Discussion] Honkette1738:
I did a quick check of the github issues. Seems others have tried doing it on the LG Q6/G6 and reached a standstill, however those were ~2016-2018. Maybe something with lglaf has changed since then?
[LG G6 Guides, News, & Discussion] luridphantom:
part of the lafsploit in the article i posted was about @shinyquagsire finding a way to send fake SIGN commands to handle the flashing. that's the new update since then, now it's about coding the hacked payload to disable secure boot and writing that with his lglaf exploit
[LG G6 Guides, News, & Discussion] mcmelon:
Any updates on rooting LG G6 phones?
[LG G6 Guides, News, & Discussion] luridphantom:
root is easy, theres an exploit somewhere on this forum
[LG G6 Guides, News, & Discussion] ze7zez:
Have you tried with the G6?
[LG G6 Guides, News, & Discussion] luridphantom:
yea my g6, v20, g5 is all rooted thanks to that exploit
[LG G6 Guides, News, & Discussion] ze7zez:
So since it's so easy for you, describe the step-by-step method of operation to help other users.
[LG G6 Guides, News, & Discussion] Honkette1738:
I believe they're probably discussing the temproot oreo exploit
[LG G6 Guides, News, & Discussion] WojtekCC:
That should be enough.

With root we should(?) be able to flash TWRP to /recovery using some app that allows it.
[LG G6 Guides, News, & Discussion] ze7zez:
When the G6 had Oreo the Official LG G6 Bootloader Unlock method worked.

Nowadays, few people have Oreo on the G6, so discussing the exploit on Oreo is of little use.
[LG G6 Guides, News, & Discussion] freeride01:
I have Oreo on my G6 (8.0). Can I unlock the bootloader?
[LG G6 Guides, News, & Discussion] mcmelon:
Really? I haven't found anything that doesn't require having the bootloader already unlocked
[LG G6 Guides, News, & Discussion] luridphantom:
yea this has already been covered in another thread so i dont need to rewrite another tutorial
[LG G6 Guides, News, & Discussion] luridphantom:
there is an exploit from 2019 that you can get root without bl unlocking. its a popular thread so if you search around here you will find it
[LG G6 Guides, News, & Discussion] mcmelon:
i have done that many times at this point and never found anything useful, could you perhaps link the thread you are talking about?
[LG G6 Guides, News, & Discussion] schroedinger:
Maybe it's possible to flash the T-Mobile (H782) Firmware to the device. IMHO the T-Mabile devices doesn't require an unlock.bin to unlock the Bootloader. According to https://techzai.com/steps-unlock-bootloader-lg-g6/
[LG G6 Guides, News, & Discussion] ze7zez:
Without the key, how could the H870 bootloader be overwritten with another bootloader?
[LG G6 Guides, News, & Discussion] schroedinger:
Just a thougt...

On some devices it's possible flash firmware for other countries or carriers, even with locked bootloader.

I don't know if the bootloader would be overwritten too in this case, or if it is possible on the LG G6

Found this thread:

https://xdaforums.com/t/convert-upgrade-the-at-t-g6-to-h873-or-us997-with-volte.3791848/

I also read something about the EDL Mode, but it seems that is impossible to get into this mode without opening the device.
[LG G6 Guides, News, & Discussion] Arnas961:
Hey everyone,

I have the h870 G6 that is running android 7. Mabye there is an exploit for this version of android? I heard that there is an exploit to some kind of exploit on android 8 but havent found the link for it. Mabye edl mode is possible to achieve my goal? Thanks in advance
[LG G6 Guides, News, & Discussion] Honkette1738:
There is temporary root but I don't think it'll help with that much.
[LG G6 Guides, News, & Discussion] youremperor:
nice
[LG G6 Guides, News, & Discussion] ryo5:
#define UNLOCK_KEY_SIZE 32 #define SERIAL_NUMBER_SIZE 16 #define DEFAULT_SERIAL_NUM "0123456789ABCDEF"

char fb_unlock_key_str[UNLOCK_KEY_SIZE+1] = {0};

gpt answer:

(The code snippet defines the constants UNLOCK_KEY_SIZE and SERIAL_NUMBER_SIZE as 32 and 16 respectively. It also defines DEFAULT_SERIAL_NUM as a string literal "0123456789ABCDEF".

Lastly, it declares a character array fb_unlock_key_str of size UNLOCK_KEY_SIZE+1 and initializes it with all elements set to 0.)

extern u32 get_devinfo_with_index(u32 index);

gpt answer:

(

The provided code is a function prototype declaration for a function named "get_devinfo_with_index".

The function is expected to return a 32-bit unsigned integer (u32) and takes a single parameter - an unsigned 32-bit integer (u32) named "index".

The purpose and functionality of the "get_devinfo_with_index" function are not clear based on the given code alone. Additional implementation or context would be required to understand its functionality.)

extern int get_serial(u64 hwkey, u32 chipid, char ser[38]); extern void sec_get_serial_number_from_unlock_key(u8 *unlock_key, u32 unlock_key_len, u8 *cal_serial, u32 cal_serial_len); extern int sec_set_device_lock(int do_lock); extern int sec_query_device_lock(int *lock_state);

gpt answer:

(

The code provided declares four functions:

get_serial: This function takes three arguments: hwkey of type u64, chipid of type u32, and ser of type char[38]. It returns an int value and is defined elsewhere. This function is most likely used to retrieve the serial number of a device based on the provided hardware key and chip ID.

sec_get_serial_number_from_unlock_key: This function takes two arguments: unlock_key of type u8* (pointer to an unsigned 8-bit integer) and unlock_key_len of type u32 (unsigned 32-bit integer), and cal_serial of type u8* and cal_serial_len of type u32. It doesn't return any value. This function is most likely used internally to calculate the serial number from an unlock key.

sec_set_device_lock: This function takes one argument do_lock of type int and returns an int value. It is most likely used to set the lock state of the device. The do_lock parameter indicates whether the device should be locked (1) or unlocked (0).

sec_query_device_lock: This function takes one argument lock_state of type int* (pointer to an integer) and returns an int value. This function is most likely used to query the current lock state of the device. The lock_state parameter will be updated with the current lock state (locked or unlocked).)
[LG G6 Guides, News, & Discussion] RafaMena13:
I used my LG G6 again today and I remember to had the bootloader unlocked but now it say that is locked, I still have the unlock.bin that LG sent me in 2017 but now it says that is a wrong bootloader unlock key when I try to flash it again, what can be happening?
[LG G6 Guides, News, & Discussion] RafaMena13:
I noticed now what is the problem, my phone has a different IMEI that the unlock.bin wtf, I've never spoof anything as I'm the first and only owner of the phone
[LG G6 Guides, News, & Discussion] ze7zez:
This is impossible. If it was in the service center, the MoBo may have been replaced.
[LG G6 Guides, News, & Discussion] RafaMena13:
I don't remember if I had to send the phone to repair but has to be that, is so sad that I won't be able to root the phone again
[LG G6 Guides, News, & Discussion] tracid1987:
It smells like spark of hope. Just leave my locked LG G6 to die on Android 9 in peace... :/ :D
[LG G6 Guides, News, & Discussion] TropicoX:
I needed a backup smartphone and I've always been happy with LG after short time with Samsung (bad experience with A40). So I bought a new (old stock) LG G6 for little money but I only now realize no way to unlock bootloader. :(

I run daily LG G7 but G6 is nicer and more compact. To be honest, I didn't remember Android 7.0 being so fluid and less bloatware vs Android >9. Hope is the last to die, in the meantime I don't update to Android 8 or 9.
[LG G6 Guides, News, & Discussion] xc112:
feel bad you guys were not able to unlock , device can still run andrroid14
[LG G6 Guides, News, & Discussion] Dawdler9085:
I've been searching now for 2 days for a method to unlock bootloader on H870DSU running android 8.0.0. Can someone please tell me if I should just give up?

:cowboy:
[LG G6 Guides, News, & Discussion] xc112:
afaik only the lg872 can be unlock now
[LG G6 Guides, News, & Discussion] P_1986:
¡Hola!

Nueva forma de desbloquear el bootloader del LG G6 sin el archivo .bin?
[LG G6 Guides, News, & Discussion] Jostian:
I'm with you, South African version of the 870, so frustrating...
[LG G6 Guides, News, & Discussion] Akhayev:
Do you think VS988 will be able to unlock ?
[LG G6 Guides, News, & Discussion] lmiked:
Well...

As far as I understand, that would be 1 reason for them NOT to unlock the bootloader on the EU, since it is more likely that that will get phones to brick... And they still have to provide warranty... While the same is not valid for the most of the other continent's and countries...

But, I don't think that's the real reason for them not to unlock the bootloader for other regions...

Anyway, I am now a 100% sure that the LG G6 H870 variant, is the exact same model physically and hardware wise as the Euro version, as I flashed my South African G6 with the Euro Open Opt .kdz file... And it worked/works just fine everything.... No errors, no nothing, I didn't even lose any data as I set LGUP to upgrade instead of refurbishing...

Someone said that maybe if we flashed other regions variants with Euro, we might be able to unlock, it made some sense at first... But then it hit me, that the IMEI and device ID would still be the same... So it's a no go... I even tried resetting the phone after backing up thinking that maybe, that way it might generate a different Device ID with a Euro firmware... But, no still the same, so still no unlock.

I had an interesting idea though... I think I know how we may be able to unlock all the variants of any LG phone model that unlocks with this method, that is G4/G5/G6... But we'd need a Dev, which I'm not...
[LG G6 Guides, News, & Discussion] Jostian:
Hi how did you flash the euro open. kdz? Is it something easy enough to do?
[LG G6 Guides, News, & Discussion] tonime:
LG unlock 870DS please.
[LG G6 Guides, News, & Discussion] lmiked:
Yes, it's quite easy... [MENTION=2684188]autoprime[/MENTION] has everything you need at the 1st page of this topic/thread... I used the same LGUP version I used to use to flash the G4, though, it wasn't recognising my G6, so I read a little and saw about the UPPERCUT, which is a tool autoprime wrote/made that allows LGUP to detect almost all LG mobile smartphones without having to intall any other extra drivers... Just install LGUP and the latest mobile drivers (which are all on the 1st page), download the .kdz you wish, and run UPPERCUT, it will launch LGUP and detect your phone "automagically"... Then I believe you know how to proceed...

Note though, that all the .kdz files only allow to flash in upgrade mode... I tried refurbish, and it gave me an error saying something like "0x00002 this kdz file does not support refurbish mode" or something like that... Then I just clicked ok, and chose upgrade, and it flashed no problem... Restarts twice... You won't lose any data at all.

But I flashed back to my region ZAF (South Africa) today, since I saw there was a new update yesterday before flashing the Euro FW... And since that won't affect at all with unlocking the bootloader...

---------- Post added at 12:25 AM ---------- Previous post was at 12:08 AM ----------

Hey [MENTION=2684188]autoprime[/MENTION], 1st of all, thanks for all your contributions!!!

So, I had an idea about how we could get around to unlocking all variants, and I'd like to know what you think, and whether it is possible...

So it goes like this... As far as I know, the bootloader unlock service is automatic, basically, when you got to the website, it requests your IMEI and Device ID, it checks it against the Database to confirm it is a supported (EURO or other supported regions) model/ID, then it grabs the (base) unlock.bin file, signs it with either the IMEI, or the Device ID or both, or with a generated key made for that specific device ID and mails it to the logged in user's email, correct???

So my idea is, for what I saw, the unlock.bin file is only 1.2mb or around that in size (if I'm not mistaken), so 2 different users from Euro region or any region which supports bootloader unlock, could provide you with their own device's unlock.bin file and Device ID, and you could compare them side by side on an HEX editor, and see where they differ, since most of the file will be the same, that being the code which unlocks the bootloader, the small part that differs, would either be the Device specific ID or generated key to unlock, and from there, maybe we could find a way to generate the keys ourselves or just replace the device ID in case that is (unlikely) the only difference in the unlock files...

Is that something plausible/possible??
[LG G6 Guides, News, & Discussion] Ken C:
Found this on the oneclick root website. They seem to be able to do something with the t-Mobil version of this device. Might just be garbage but was wondering what greater minds may think. They still say they're waiting on twrp for us.

http://www.stupdroid.com/2017/04/root-twrp-lg-g6-h872.html?m=1
[LG G6 Guides, News, & Discussion] autoprime:
Unfortunately LG uses a private key to make the unlock.bin files and the true device-id cannot be changed. See this post here.. the quote in it plus response should explain it all https://xdaforums.com/g4/help/unloc...e-unlocked-t3165391/post64487746#post64487746
[LG G6 Guides, News, & Discussion] Jostian:
Thanks lmiked, just want to check, you say you went back to the ZAF region due to an update, but wouldn't you get the Euro updates, which would probably come faster than ZAF ones? thanks.
[LG G6 Guides, News, & Discussion] lmiked:
Hum... Ok. I thought that maybe by checking the difference between the unlock.bin files, there could be a way to decrypt the key and make a keygen... Also, when I said change the Device ID, I meant the one on the unlock.bin file...

Anyway, I'm going to read the link you sent so I can understand better...

---------- Post added at 08:42 PM ---------- Previous post was at 08:40 PM ----------

Well... I don't know which one will get updates faster... But the Euro version is 10d and was still on 10d without any update popping up... While the ZAF I just updated to 10f yesterday via OTA!!
[LG G6 Guides, News, & Discussion] Jostian:
Ah OK, does the Euro version have all the vodacom junk apps on etc? Vodacom startup and wallpapers etc?
[LG G6 Guides, News, & Discussion] Mjuksel:
Nope, there is no carrier specific junk on the EU 870.
[LG G6 Guides, News, & Discussion] Jostian:
I flashed the Open Euro .kdz, but all my carrier junk remains after the flash, seems like the carrier has 'hardcoded' their stuff some how, pity, thought flashing the Open Euro kdz will get rid of the carrier junk... :( anyone with a link to the latest ZAF .kdz, the link in the stock ROM thread doesnt work and its for the older kdz anyhow, thanks.
[LG G6 Guides, News, & Discussion] lmiked:
You can download it!! The link works... But you have to use XDM (download manager) is there on the thread... It's free and quite good... I got the error as well when I tried downloading it on the browser... Both Firefox and Edge... To download it through browser, you gotta install some addon and change the User Agent information... Too much trouble. The XDM is a lot better, plus I think it supports pause and resume download.

I installed both the euro and the ZAF, and on both I had no network bloatware... But then mine is a operator free unlocked, G6.

If you flash the ZAF, and then check for updates you should get a 10F version 555mb OTA update... Battery life seems to be improved!!

Cheers!!!

---------- Post added at 12:38 AM ---------- Previous post was at 12:35 AM ----------

Also, the reason why you didn't lose the bloatware... Is because you probably flashed the .kdz in upgrade mode, since this kdz's apparently don't support refurbish... If you refurbished... The bloatware would probably have been gone... You should try backing up and resetting the phone after flashing the kdz... You might then get rid of the bloatware!!

Cheers!!
[LG G6 Guides, News, & Discussion] Jostian:
Ah, brilliant idea, will try that, thanks.
[LG G6 Guides, News, & Discussion] ElPsyyCongroo:
hi, I buy on UK website LG g6 dual sim unlock H870DS 64gb.

LG G6 Dual SIM	H870DS	Russia, Hong Kong	Europe, Asia

i can do root/bootloader unlock? thanks
[LG G6 Guides, News, & Discussion] chaos90222:
No, official unlock only works on H870, not dual sim

Version
[LG G6 Guides, News, & Discussion] Jostian:
Yip this worked, but one must test via hard reset, but all carrier junk is gone, now if the Euro Open 10i kdz would just arrive...
[LG G6 Guides, News, & Discussion] lmiked:
Great!! Glad it worked!

I happy on the ZAF kdz... Already got the 10f update... Have enjoyed incredible battery life!!

Anyway, what is really bugging me is the Bootloader unlock restriction...

In fact I'm going to Write an email to LG and send it to as many addresses as I can find from then... And request support on unlocking the bootloader, even if I have to sign a consent form in which I give the warranty or legally unbind them from having to provide warranty should anything​ go wrong with my device after unlocking... I really want to get Root access... TWRP would be nice too... But it's root that want the most!
[LG G6 Guides, News, & Discussion] kimitza:
H870 is already unlocked. Now we need devs for custom roms :). Or at least for themes and stock mods. I'd love to have stock lg launcher auto-rotate and custom grid size.
[LG G6 Guides, News, & Discussion] lmiked:
Only Euro H870 Variant is unlocked... Mine is H870 ZAF Region... So I can't unlock... They control unlocking by IMEI and Device ID... If it's not Euro... You can't unlock...
[LG G6 Guides, News, & Discussion] Pipould:
What do you think about that: https://www.youtube.com/watch?v=EpaW0-8-QKY Could this work ?
[LG G6 Guides, News, & Discussion] lightdelegate:
thanks

I have a problem

no matter what i do

after i enter the fastboot, i try to get the id and get "waiting for any device" and nothing work

tried 2 pc's :(

any solution ?