yashsingh1/xdaforums huggingface dataset:
[LG G6 Guides, News, & Discussion] Jeff_i:
I would really like too ...

I've found this "universal method"

Universal bootloader unlock method has been found for the LG G8, G8S, G8X, and V50 ThinQ

... but for more recent devices (not so universal finally :-)
[LG G6 Guides, News, & Discussion] tracid1987:
I just wanted to enter the LG website and realized that i am late to unlock bootloader, they shut down the site just lately :( so if anybody has any solution please let us know. I would be so grateful. Thank you
[LG G6 Guides, News, & Discussion] network-samurai:
Has anyone looked up the specific URL for bootloader unlock on the waybackmachine "archive.org" great website which archives the internet and allows you to travel back in time and visit websites which no longer exist in the present.
[LG G6 Guides, News, & Discussion] tracid1987:
You are (almost) a legendary hero :) i have just checked the site, has found the "start unlocking the bootloader" section but then i got this message unfortunately. But i might be wrong, please try it yourself.

BTW i dont think it could work because its not a simple site but you have to login and receive a bin file. These two factors make it impossible i think.

BTW thank you for the link
[LG G6 Guides, News, & Discussion] network-samurai:
i am reading the source of the page now, the page button redirects to https://developer.lge.com/resource/mobile/IssueDeviceInfo.dev after running through archive.org this page has a snapshot but redirects to a login page. I imagine anyone with a user account should be able to access it.
[LG G6 Guides, News, & Discussion] tracid1987:
Isnt it possible to just register as usual? i mean there are other LG products you can register and you should be able to create a global LG account
[LG G6 Guides, News, & Discussion] network-samurai:
yes try logging in then in a separate tab open https://web.archive.org/web/2017022...r.lge.com/resource/mobile/IssueDeviceInfo.dev
[LG G6 Guides, News, & Discussion] network-samurai:
That link is from February 23 2017, there are others you can also try @ https://web.archive.org/web/2017070...r.lge.com/resource/mobile/IssueDeviceInfo.dev
[LG G6 Guides, News, & Discussion] tracid1987:
I have just registered. But after opening this link it says page under construction :D funny :)

I have seen a post a member is seeking devs into his team to reverse engineer the algorythm. I think now is a big hope they will succeed.

Until now they were not motivated because the LG site was working so why spend time developing something which is alredy there for you. But now its gone so its a motivation to challenge themselves and find a solution. If they can solve safetynet they can solve this as well. I will be ready to support them by donating, i wont want the bootloader unlock for free :)
[LG G6 Guides, News, & Discussion] network-samurai:
Try the 2019 link https://web.archive.org/web/2019111...r.lge.com/resource/mobile/IssueDeviceInfo.dev
[LG G6 Guides, News, & Discussion] tracid1987:
says "Under construction"
[LG G6 Guides, News, & Discussion] tracid1987:
You are really a network samurai :D you should post this info elsewhere as well in other LG threads. somebody may team up with you to analize
[LG G6 Guides, News, & Discussion] network-samurai:
If we could get hold of an unlock.bin file and analyse the meta information we could possibly find out what the fileId contains, maybe it's just a simple device identifier. Then we would all be able to download our bootloader unlocks directly from source.
[LG G6 Guides, News, & Discussion] tracid1987:
Somebody must have a bin file on this forum. try to ask
[LG G6 Guides, News, & Discussion] WojtekCC:
Do what you need to do.
[LG G6 Guides, News, & Discussion] Cryomichel:
Keep going guys !!! I own a G5 H850 and I'm depserate to unlock the bootloader and try custom roms before changing phone !!

I a have a H850 running Oreo and I could provide Imei and device Id if needed !

I tried several LG supports and they dont want to hear anything sadly!
[LG G6 Guides, News, & Discussion] Jaceksgal:
Wciąż jest szansa na odblokowanie bootloadera w LG G6 ?
[LG G6 Guides, News, & Discussion] Lord87:
No there is not (nie ma).
[LG G6 Guides, News, & Discussion] rs2580:
How to check if my bootloader is blocked or not?
[LG G6 Guides, News, & Discussion] Heythane:
adb reboot-bootloader

fastboot getvar unlocked

=>unlocked: no : Bootloader is locked
[LG G6 Guides, News, & Discussion] Propellastic:
Hello.

Another one here that wants to unlock the bootloader to install custom roms! I hope it can be possible again...
[LG G6 Guides, News, & Discussion] crexcrex:
Does anyone else have an unlock.bin file? Having several ones would help reverse engineer them.
[LG G6 Guides, News, & Discussion] 7GanDaLF7:
[TOOL][G6] TOOL ALL IN ONE (Drivers|Unlock|TWRP|Factory Image|Stock Recovery) With this tool is not possible to unlock bootloader?

At the moment possible or not to install custom ROM for LG6 H870 ?
[LG G6 Guides, News, & Discussion] Heythane:
Possible if your bootloader is unlocked. The problem is LG doesn't unlock bootloader anymore.
[LG G6 Guides, News, & Discussion] 7GanDaLF7:
[TOOL][G6] TOOL ALL IN ONE (Drivers|Unlock|TWRP|Factory Image|Stock Recovery) can i unlock bootloader unofficially with this tool ?
[LG G6 Guides, News, & Discussion] Heythane:
No you can't. Still need the unlock.bin file. Only LG was able to provide it.
[LG G6 Guides, News, & Discussion] Honkette1738:
From the looks of it, the tool just removed the need to use the command prompt. It requires the LG developer services, which is now unavailable.

Kinda sad that LG provided ppl no way to unlock them, and that the G6 is one of the only that hasn't been cracked open.
[LG G6 Guides, News, & Discussion] tracid1987:
here: https://xdaforums.com/t/rooted-lg-g...ed-from-lg-to-unlock-your-bootloader.4411095/
[LG G6 Guides, News, & Discussion] crexcrex:
thanks, though i'm having a hard time figuring out where the IMEI/MEID is making into the binary if that's how it works.
[LG G6 Guides, News, & Discussion] masterchapter:
hi, any news...?
[LG G6 Guides, News, & Discussion] Man_tzagk:
any news on new ways to unlock ?
[LG G6 Guides, News, & Discussion] AlexSmitterson:
Hmm, I have now G6 H870 and H870DS and both require unlock.bin and careless LG so selfish or greedy to share key to unlock them, geeez.

My dreams of custom roms on perfectly working devices with outdated non-secure OS crushed argh
[LG G6 Guides, News, & Discussion] WojtekCC:
I have an idea!

We should be able to obtain (temporary) root by exploits (maybe this?: CVE : 2019-2107), and install twrp from OS.

I have done that on android 4.2? or 4.4

But i have no clue how to do that on android 7,8 or 9.

Because the only thing we need is TWRP on recovery partition.
[LG G6 Guides, News, & Discussion] Honkette1738:
How could that help with unlocking the bootloader?
[LG G6 Guides, News, & Discussion] WojtekCC:
We unlock bootloader to install TWRP by "fastboot flash recovery(?) (something)"

AND after that install (most often) Magisk.

When we obtain root by some exploit or something, we should be able to install twrp without need to unlock BL
[LG G6 Guides, News, & Discussion] Honkette1738:
Interesting, I'm not sure how it could be pulled off, because i'm not skilled with that sort of thing. Maybe you should try, you did say you had experience
[LG G6 Guides, News, & Discussion] AlexSmitterson:
there is even a change.org petition (5 years old) to give out keys, but we're still on square one

I am sure many people would really appreciate if we get a workaround at least - so, WojtekCC, if you could test the suggested approach it would be awesome !
[LG G6 Guides, News, & Discussion] WojtekCC:
I didnt say I have experience. I said I have done it once on android 4.

On android 7-9 should be doable.
[LG G6 Guides, News, & Discussion] Man_tzagk:
How did you do it? Do you have a link to the video/software you used ?

Cause the inplmentation would be the same, the only thing that would change would be the files used!
[LG G6 Guides, News, & Discussion] Honkette1738:
On my G6 the Android security patch level is May 1, 2019. That should mean 2019-2107 should work since it was found in ~July 2019, right?
[LG G6 Guides, News, & Discussion] WojtekCC:
Probably, there is only one way to find out.

I dont think it even counts because I used farmaroot for some oldish phone.

I would test it myself but i have to sell few things and maybe buy some lg phone from some marketplace.
[LG G6 Guides, News, & Discussion] Man_tzagk:
Hmm. Farmaroot doesn't seem to be open source. It did support some older lg devices but i don't think the security was in any way the same. It does use a video exploit and maybe by unpacking it and editing the source video and payload we could boot into twrp, or more unlikely, install magisk.
[LG G6 Guides, News, & Discussion] crexcrex:
Hi, sorry for late reply, today I sat down to play around with the provided unlock.bin. Little progress yet. So far I've noticed these things:

The data takes up 543 bytes, the rest are zeroes

File begins with

0x000000: 0x9e 0x15 0xb7 0x8d 0x6b 0xd3 0x7e 0x2d 0x01 0x00 ....k.~-..
0x00000a: 0x00 0x00 0x02 0x00 0x00 0x00 0x00 0x01 0x00 0x00 ..........

There is a 12 byte long sequence of `0x00` which begins at `0x114` and ends at `0x11f`. Maybe that's a separator between IMEI/Device ID?

I've only tested 2 unlock.bin's, and seeing these features shared across both files, I'm pretty certain that these attributes are present in all unlock.bin files for LG G6 (not sure if files vary from variant to variant eg. H870, US997, etc.)

The idea that the file contains Device ID and IMEI is purely my speculation, and LG could've had another means of dishing out unlock.bin's; HOWEVER, there are clearly two regions in the file separated by a 12 byte `0x00` string, suggesting that IMEI/Device ID are stored here. I choose to believe this for now and see if I can decode that data.
[LG G6 Guides, News, & Discussion] tracid1987:
many people are still upgrading their custom ROMs, maybe it would be useful to ask them for their unlock.bins and other data? They arent reading this here because their bootloader is unlocked but we might ask them in the custom ROM section...
[LG G6 Guides, News, & Discussion] crexcrex:
I doubt it would be of any help at this point... I'm pretty sure we already know correctly how the file is parsed but we just need the private key LG used to sign the files with.

The lore here:

https://xdaforums.com/t/rooted-lg-g...-unlock-your-bootloader.4411095/post-88035029
[LG G6 Guides, News, & Discussion] tracid1987:
francians wrote this in the other thread after his long explanation so as i understand his words he is still looking for device ID and IMEI data with unlock.bin file. and you have replied to that post to. So I am confused now :D :D
[LG G6 Guides, News, & Discussion] francians:
Hi,

yes, that post is obsolete. "Just" private key is missing .

Cheers
[LG G6 Guides, News, & Discussion] tracid1987:
I have made a desperate clown out of myself and sent a mail to LG in hope some senior dev starts feeling sorry about us and maybe can dig some archives up on their computer.

Dont laugh at me i know its silly idea but hope dies last :) its hard to let go
[LG G6 Guides, News, & Discussion] crexcrex:
Not a clown, our most feasible option now is to get the private key from LG I think... I hope they haven't lost it :)

Edit: I realized the private key might be used for something else and if not, that's the reason why it's private, for security (planned obsolecence aside). So I think we should somehow get them to enable us to have those files without the key, if that makes sense.
[LG G6 Guides, News, & Discussion] francians:
I've checked if it's the same of their websites and can tell you it's not. I don't think they will share it, anyway I wrote them too (why not?). It's not a matters of obsolescence, IMHO, they did it in a reasonably strong way.
[LG G6 Guides, News, & Discussion] tracid1987:
LG developers are responding super fast, i did not experience such fast rejecting customer "care" before :D

they responded with almost the same text as half a year before (with the same speed) when i was asking for the unlock.bin files. I cant believe somebody just wipes everything from the past business so i believe they just dont want to deal with it anymore. Not a slightest chance.
[LG G6 Guides, News, & Discussion] crexcrex:
Guess we'll have to rely on exploits.
[LG G6 Guides, News, & Discussion] francians:
If anybody wants to exploit it (without knowledge) I did a small script that generates random keys and compare them with the public key.

The math behind is: there is a very very large number (public key's modulus: n) that is obtained by multiplying 2 prime numbers (p and q), if one of these are shared with a different key, the GCD (greatest common divisor) will reveal it. Is it so simple? You can read more on wikipedia:

RSA (cryptosystem) - Wikipedia

en.wikipedia.org

RSA Factoring Challenge - Wikipedia

en.wikipedia.org

RSA numbers - Wikipedia

en.wikipedia.org

I'm not responsible of any damage caused by this script to your computer (may overheat) and discourage anybody by publishing online any result.

If you are sure of what you're doing, you can run it in your shell:

java -jar lg-hack.jar

Cheers
[LG G6 Guides, News, & Discussion] crexcrex:
So this basically bruteforces the private key? I meant by exploit a bug in the stock ROM that would allow to root or something.
[LG G6 Guides, News, & Discussion] francians:
Basically yes. I currently don't have anything better to suggest
[LG G6 Guides, News, & Discussion] tracid1987:
Sorry for the question if it sound silly but i am too noob for this. This code runs on windows and brute forces the inserted unlock.bin file?

How about doing this brute force on a cloud machine? isnt it more effective?
[LG G6 Guides, News, & Discussion] francians:
It runs on any machine that supports Java and no, doesn't do anything with unlock.bin, but with a success result would allow to generate any unlock.bin. A cloud machine could be faster, but expensive
[LG G6 Guides, News, & Discussion] ze7zez:
H:\>java -jar lg-hack.jar
Start
Attempt: 0
Attempt: 1000
Attempt: 2000
Attempt: 3000
Attempt: 4000

Does the script start over after each run?

What is the expected number of retries?

What will the script do when it finds a result?
[LG G6 Guides, News, & Discussion] WojtekCC:
Almost forever.

One "tile" is 1 byte = 8 bits = 2^8 combinations

There are 16 columns and 34 rows = 544 "squares"

So, (if i didnt make mistake) we will have at worst to check (2^8)^544 variantions.

We should better go with some temp-root exploit.

View attachment 5858141
[LG G6 Guides, News, & Discussion] francians:
Well, consider that researchers discovered 0.2% of 1024-bit RSA keys was vulnerable to this kind of attack on a base of 120.000 elements. Doubling the key size (our case) probably means make it 1000 times more complex.

I printed the number of keys generated in order to check the computer speed and see the script it's not blocked. If a match is found the script will output the GCD and will stop. I'm running on it RPI, very slowly but constantly. Since doing every single attempt would require thousands of CPUs and many years of work, I imagine that trying random keys could have more chances anyway. If one of us is just lucky maybe will tell us. I'm studying a new method to start a more reasonable approach if a close public key is found, but I'm far from releasing something.

I'm sorry I don't have any good news
[LG G6 Guides, News, & Discussion] francians:
The unlock.bin content is already known. We need a private key to generate the signatures verified by the bootloader. Since I wrote a validator you could also generate a perfectly valid unlock.bin for only your phone in 16^(256*2) attempts, but I prefer to try to find the key for all :)
[LG G6 Guides, News, & Discussion] ze7zez:
The fact that you are doing something is good news. (y)
[LG G6 Guides, News, & Discussion] ZandorFelok:
What points of contact is everyone using to bug current LG developers to request post-shutdown support with acquiring unlock.bin files?

LG G6 - US997

(bootloader) Device-ID

(bootloader) 7FD3C92F8BFF81680EE84C352EF72DF7

(bootloader) BDDB62A246EA0A1051451592E1471E26

(bootloader) ----------------------------------

(bootloader) IMEI

(bootloader) 355274082663750
[LG G6 Guides, News, & Discussion] francians:
Hello,

I discovered that many signature could be generated for the same clear text (probably was obvious but I did some testing to confirm this), so between the infinite combinations is not only one the possible unlock.bin valid for your phone.

I'm re-evaluating the brute force as option and put together a tool. It's very raw and I cannot say I did it yet with it.

In order to run it open a console and run:

java -jar lg-bf.jar

Just compile every field and press "generate".

I suggest to download an existing unlock.bin from this forum and select that one as file of input (if you're lucky it may help to skip billions of combinations full on zeroes, if you aren't you will have to reach last combination).

I didn't put any alert when the script has done, but you will see it in terminal and the computer should stop crying.

If you press suspend (sometimes you should do it) the file will be written on disk so you can resume later (or immediately)...

You will see something like:

Start attacking first signature

User cancelled

Start attacking second signature

User cancelled

Start attacking first signature

User cancelled

Start attacking second signature

User cancelled

Start attacking first signature

User cancelled

Start attacking second signature

User cancelled

Start attacking first signature

If you have a valid file, the output will be:

Start attacking first signature

Verified

Start attacking second signature

Verified

That's all.

PS I'm not responsible of any damage caused by this script to your computer.
[LG G6 Guides, News, & Discussion] ze7zez:
Something is wrong.

The Java(TM) Platform SE binary process consumes 0% of the CPU, and when you press Suspend, a message appears "No generation process is running."
[LG G6 Guides, News, & Discussion] Honkette1738:
Trying it on my PC and it's stuck on "Start attacking first signature".
[LG G6 Guides, News, & Discussion] tracid1987:
Any update? I hope you forgot to inform us about the breakthrough :D

:D:D
[LG G6 Guides, News, & Discussion] Tyealia:
Just went through so many tutorials to try to get this working and learned so much then find out I cant unlock the bootloader lol. Someone please fix this or add big red notices on all the roms
[LG G6 Guides, News, & Discussion] freeride01:
Another user here who hasn't unlocked their H870 before LG removed the option.....

Needless to say - this really, really, REALLY sucks.

Very surprised that a supposedly reputable company will handle things in the manner they did.

I'm thinking of boycotting all LG products from now on.
[LG G6 Guides, News, & Discussion] elnigno:
Me too, it really, really sucks.

@francians Any chance you could share the code of the tool you posted back in March?
[LG G6 Guides, News, & Discussion] francians:
Hello,

It simply generates a random public key and tries to GCD it, but it's thousands times harder than winning the lottery to find a matching one. I did several attempts I didn't share like trying to brute force the signature and even after several weeks it still stuck on the first one, I checked if the key was generated from a non secure generator (see debian bug), I tried with some tool that uses multiple math algorithms.. Nothing at all.

On my hard drive I have a collection of primes numbers, I will do a latest desperate attempt and if nothing will work I will share it so you can start from it

Cheers
[LG G6 Guides, News, & Discussion] DeployThis!:
Hi,

As I really liked the approach of @francians of trying to brute force a private key and trying to generate a lucky guess for a single user unlock.bin, I decided to start both Java-apps and planned to report back after a month or so here.

After 3-4 days I was surprised to see the brute force app stopped with the last line of output simple reading "End".

I an not sure what it means, I will post the generated output here and hope that @francians can comment on it.

Furthermore, it would be nice if the program would ask for a optional starting Attempt-counter, so that others need not to start this effort all the way from attempt 1. If we would regularly check in here stating our Attempt-counter, others could benefit from it this way. Another idea would be to invert the approach and start from the other end, so that the 2 approaches would grow together and meet somewhere in the middle (theoretically halving the time). A last RFC would be for the random guessing app, to modify it in such a way, that it would not use any graphical libraries in order to run it headless or from a CLI (and let it run using nohup as I did for the brute force app).

Here is my output:

Attempt: 382000
Attempt: 383000
Attempt: 384000
Attempt: 385000
Attempt: 386000
Attempt: 387000
Attempt: 388000
Attempt: 389000
Attempt: 390000
Attempt: 391000
Attempt: 392000
Attempt: 393000
Attempt: 394000
Attempt: 395000
Attempt: 396000
Attempt: 397000
Attempt: 398000
Attempt: 399000
Attempt: 400000
Attempt: 401000
Attempt: 402000
Attempt: 403000
Attempt: 404000
Attempt: 405000
Attempt: 406000
Attempt: 407000
Attempt: 408000
Attempt: 409000
End
[LG G6 Guides, News, & Discussion] francians:
Hi,

Thanks for sharing and of course thanks for the trust and the help.

Unlucky I think I put a limit in the loop of 410k certificates generated..

I'm really sorry to say that the program was meant to print a prime number being part of the private key.

It means that your machine generated 820k random prime numbers and didn't find a common factor.

I wrote it this way because I was hoping it was a big enough pool to have a chance, but random because you just cannot simply try every next prime ( like in Fermat factorisation), if it would work modern bank systems would be at risk.

I will keep you posted if I have new ideas or suggestions for how to hack the Beast
[LG G6 Guides, News, & Discussion] tracid1987:
Come on Mr. Brains, we are not going to keep this LG G6 forever :D (just kidding :) and i didnt want to spam this thread with garbage messages, i just wanted to signal that there are people still out there with their LG G6s waiting to be unlocked :) thank you for your work and efforts. BTW i could not help in this since i dont understand a single word what are you talking about :( )
[LG G6 Guides, News, & Discussion] francians:
I think I don't care to break my own G6 as it's a spare phone. Occam's razor: I'll try to change IMEI and Phone id and see if I can unlock it using the unlock.bin provided. Theoretically it could work, but it's a grey zone and cannot make a guide about it on XDA because of the rules.

I'll let you know

EDIT 1:

I did some research. First of all the fastboot device ID (in LG world) is not the Android device ID (as the name may suggest) and doesn't change after factory reset. The device ID used by unlock method it's probably the sha256 of a 16 characters hex string (2 32-bit unsigned int) zero padded.

I cannot figure where do they took this number, but definitely doesn't look the phone serial Number. It may also be not visible from Android, since it's retrieved from a kernel API call. The bad news is that even if we find that value and understand how to change it, we will need to discover the original value before the hashing of the posted working device ID to make it work with it's unlock.bin. I will have more time next week, but don't expect too much
[LG G6 Guides, News, & Discussion] nach_0.0:
Hello!, I have an LG G6 THINQ with the bootloader locked, if you need data or something, let me know if you need anything. model: LG-H870 SOFT: V30e-722-34 BASEBAND: MPSS.TH.2.0.1.c3.1-00036-M8996FAAAANAZM-1.201665.1.215092.1 COMPILATION: PKQ1.190522.001
[LG G6 Guides, News, & Discussion] nach_0.0:
View attachment 6024906
[LG G6 Guides, News, & Discussion] FosCoJ:
Do you need any data? Got 2 LG G6 lying around, one with broken WiFi as a LTE-Router Backup and one working one, I would like to Unlock...