yashsingh1/xdaforums huggingface dataset:
[LG V20 Guides, News, & Discussion] TheMadScientist:
That has always been the rite track just to get to download mode.

I thank you for providing the files. Its always stressful when dealing with owns hardbrick. ive spent hours of burning images to mine lol even fried a couple sd cards

but most def seems as if you are knowledgeable also in this area so id love to keep you in this loop

If we all can pull this off. We will be the next heros of the day lol also if u are interested in reading some suposedly the s8+ also has same boards so even may be able to piece stuff from there

and i know sammys have been booted of sd in the past.

the more people we can get the better
[LG V20 Guides, News, & Discussion] walidham:
hi did you found a solution for h918 ? i hard bricked my phone
[LG V20 Guides, News, & Discussion] walidham:
someone say that mledusa pro support h918 ufs repaire

1st World LG V20 H918 REPAIR DONE via UFS - GSM-Forum

1st World LG V20 H918 DEAD BOOT REPAIR DONE AFTER DOWNGRADE VIA UFS BY THE GIANT MEDUSA PRO LOG INFO : Code: Welcome to Medusa Pro Software version 2.1

forum.gsmhosting.com
[LG V20 Guides, News, & Discussion] askermk2000:
Apparently Medusa now supports H918, Medusa @ gsmhosting

I also saw that there where posted "LG V20 (H918) Dead Boot Firmware XML + Loader By Andi-Gsm -t" on a few gsm sites, but the link is no longer functional.

Would be nice to be able to revive my V20 again after all these years.

Edit: Hmm wait, that above (medusa) seems to be by connecting directly to UFS chip..?
[LG V20 Guides, News, & Discussion] Prowler_gr:
Not exactly right, it's just a raw copy of my mmcblk0 partition, which should contain the bootloader (not the whole UFS chip)...

dd if=/dev/block/mmcblk0 of=/sdcard/H990DS-Loader.img bs=1024 count=168960
[LG V20 Guides, News, & Discussion] askermk2000:
OK, now I know what's going on. I have mounted the file in windows now (in linux it gave error), this is actually an image of your *SD-Card*.

Like I tried to explained in my OP, there is a new type of firmware on these UFS chips. It's no longer a single device, it's not even "mmc" as in mmcblk0 or 1 or 2 etc. It's /dev/sda /dev/sdb /dev/sdc ... etc

PS: You should probably remove that download. hehe :)

I added a new line to the first post, to explain this better. I realize now this should have been clarified better.
[LG V20 Guides, News, & Discussion] Prowler_gr:
Check PM ;)
[LG V20 Guides, News, & Discussion] askermk2000:
Thanks.

I sent some questions on pm to you. Initially 990ds look very different from h918 partition scheme, and there where fewer than I expected. If I am to use this I will have to download the kdz of the rom you're using, and piece together an image.
[LG V20 Guides, News, & Discussion] askermk2000:
LG as well, V10 for instance. So perhaps V20's bootloader has that capability as well, if not we're screwed. Or perhaps it's not about the bootloader, but some jumper config on the board, not exactly sure.
[LG V20 Guides, News, & Discussion] TheMadScientist:
Its funny my backup device idol 3 5.5 fastboot on this phone is Qualcom9008

The unlock commands and flash commands are a little different than just oem unlock and flash

It would be nice to find those commands on lg and reflash that way to.

So technically the idol is never hardbricked.
[LG V20 Guides, News, & Discussion] TheMadScientist:
So i know every system image has its own partition.

I partitioned my sdcard into 30 partitions, But have not tried to flash all the separate imgs to each partition as per partition layout, heck even in exact order they lie on true device not alphabetical.

This is just theory again of coarse.
[LG V20 Guides, News, & Discussion] askermk2000:
You didn't use the "mksdcard" program?

Since we can't make a sdcard look exactly like the multi-LUN (meaning several disks like sda sdb etc, and not just partitions) I'm assuming it works by GUID. So it can find the partition by it's ID, is my theory.

I've looked at the image make by *mksdcard*, it looks just like a rescue image I downloaded for the V10. It's an image with GPT partition scheme. Partitions are placed in the order you input them in sdrescue.txt

In any case, the mksdcard tools is advertised for DragonBoard 820C, so it should work for our phones as well if the prerequisites are met, like compiled support in the bootloader and so on.

I will not be able to test the dump I got from Prowler just yet, I'm waiting for confirmation from him. I need to know what exact stock version he's running, and if it's ARB higher than 0. All in all I'm bit skeptical of using 990DS files though. Isn't that model unlocked with DirtySanta? I read something about *aboot* beeing modified in the process.
[LG V20 Guides, News, & Discussion] Prowler_gr:
Sorry for not being able to respond earlier.

I am rooted with DirtySanta (engineering aboot), & the firmware I'm using is H990ds10b_00_OPEN_TW_DS_OP_1125.kdz

Remember we are aiming to emulate download mode, not decrypt the firmware or fully boot the phone.

My files should be fine for that matter.

---------- Post added at 03:24 PM ---------- Previous post was at 03:13 PM ----------

Re-check PM, I have counted 72 partitions totally
[LG V20 Guides, News, & Discussion] Prowler_gr:
Quote from post #445

If that is the case I can only suggest you use the same method, with the difference of using the

H990ds kdz

(H990ds10b_00_OPEN_TW_DS_OP_1125.kdz), & use the rest of my partitions with this & see what response you get...
[LG V20 Guides, News, & Discussion] askermk2000:
Ok.

I have tried a few thing now, and I can say for certain that the H990DS bootloader will not work on a H918.

I have made a full blown image with 70 partitions, laid out in sequence, as if it was one whole drive. This was using

only

files from 990ds dump and corresponding KDZ. The card is NOT responding at all, still shows 9008 mode when inserted.

The same result when making a more barebone image, with the same partitions I've used for H918.

So conclusion is that H990DS is too different, or they use different signature/key/signing stuff.

Edit: Was just writing while you replied.
[LG V20 Guides, News, & Discussion] Prowler_gr:
I was able to fully boot my H990ds with a full flash of US996 firmware (I'm pretty sure US996 layout is same as H918), so my money is on the bootloaders being compatible...
[LG V20 Guides, News, & Discussion] askermk2000:
Hmm, well perhaps it's checking against partitions on the UFS.

I will try to make a clean workspace, and extract only the bootloader images from your 990ds kdz, and then write those to a card. Just in case I was too tired yesterday and mixed up stuff.

BTW, looking at the first dump you gave me, there are some weird stuff. There are sblapp, instead of aboot, and pbl which I don't know is the equivalent. And all different sizes as well.

What is this?

Also some of the names are shortened, did you do this of did they appear that way. [MENTION=2630853]Prowler_gr[/MENTION]
[LG V20 Guides, News, & Discussion] Prowler_gr:
You've still got the links to both of my dumps, I surely can't see an sblapp or pbl in the zip....

Btw: My first dump was extracted through the dd= command on adb, my second dump was through LGUP...
[LG V20 Guides, News, & Discussion] askermk2000:
It's this one: drive link
[LG V20 Guides, News, & Discussion] Prowler_gr:
Ahh right...

You can omit those. Those are backups I got using Chainfire's Flashfire before bricking my phone, had them handy so I sent them to you (Flashfire is how I bricked my phone, but that's another story)...

My last Dump + kdz extraction should give you the full rom (except: modemst1 - modemst2 - userdata)
[LG V20 Guides, News, & Discussion] andy_zhang:
My us996 and h960 file.

https://mega.nz/#F!I4IHTQbR!8Pf3kwL-jirY7zrnia3cow

China user
[LG V20 Guides, News, & Discussion] askermk2000:
[MENTION=2630853]Prowler_gr[/MENTION]

Nope, just tried with H910PR. That won't boot either. So it seems only H918 files will work. I admit this was unexpected.
[LG V20 Guides, News, & Discussion] askermk2000:
So as it stands, I still need a dump of a H918 device to be able to ascertain if this method will work.
[LG V20 Guides, News, & Discussion] askermk2000:
Thank you.

It's nice to have the option, but I doubt it will work since so far only H918 has proven to affect the phone.

I may try with it later though, right now I'm a bit exhausted with the repetitive work.
[LG V20 Guides, News, & Discussion] andy_zhang:
What kind of work are you doing now?

China user
[LG V20 Guides, News, & Discussion] askermk2000:
I am referring to flashing sd-cards to test :)
[LG V20 Guides, News, & Discussion] askermk2000:
I've done some digging, and not all of the bootloader chain is on the device storage (emmc/ufs) but there's a portion on a ROM (read only memory). That is most likely why no other variant will work, and also why my device got bricked in the first place. By "frankenfashing" from H918 to H910PR with TWRP.

But then there's the question, "why is it possible to flash different variants with LGUP". That answer I do not know. But I do know that I've not seen any reports so far that anyone has successfully done this on a T-Mobile H918.

[MENTION=6984210]emdroidle[/MENTION] Perhaps you could give some insight on this. Is the PBL inside a KDZ file, dll or? But then again, it's supposed to be read-only.

Still, It seems possible to boot with sdcard IF I can get a dump of of a T-Mobile H918... So far no luck in that.

Here's some info on the bootloader. Those first bootloaders verify signature of the other's stored on emmc/ufs

About the sd-card booting itself. This attachment explains why the method works for me so far, but there is the question of sbl/xbl and whether that looks up by GUID as well?
[LG V20 Guides, News, & Discussion] andy_zhang:
Do you have any effect??? I am waiting for your good news!

China user
[LG V20 Guides, News, & Discussion] runningnak3d:
So I am back in the 9008 club. WOOHOO! So you will have someone else trying to help you out, till I get irritated and send it back to LG again. Then I will brick it again, wash / rinse / repeat.

-- Brian
[LG V20 Guides, News, & Discussion] andy_zhang:
We can stick together, send e-mail to Lg, let them release the file

China user
[LG V20 Guides, News, & Discussion] runningnak3d:
If you are talking about the QFIL elf file that we need, that is part of what the OEM licensed. In my case AT&T would have to release it .... not going to happen.

As for the SD card method, read up on Android secure boot path. Each one of us will need the boot files for our model, and there is a small problem with that for me ... there is no H910 KDZ.

I hope I am wrong, and we can pull the files off of a running phone, but I am pretty sure that no KDZ means no ability to create a bootable image -- and that is if it is even enabled.
[LG V20 Guides, News, & Discussion] markmessier8888:
I just joined the totally bricked club!
[LG V20 Guides, News, & Discussion] askermk2000:
Apparently some models are less secure than others. H990DS for instance being able to flash US996 firmware according to [MENTION=2630853]Prowler_gr[/MENTION]

or H910 can be flashed to H915 was it? I thought I could flash H918 to H910PR because they are physically the same (except for the pbl it seems). Maybe though, there are some extra "magic" going on in the kdz flashing process, if it is at all possible to modify the read-only-memory.

You wouldn't need a KDZ if you can get a full dump... or am I missing something?
[LG V20 Guides, News, & Discussion] runningnak3d:
It isn't that they are less secure, it is the fact that the PBL is the same. When you flash a KDZ, you are flashing the entire boot path, and as long as it matches the PBL, you are good. Hence H915 on H910. I bricked my phone by flashing H918 KDZ because, electrically they are the same phone .. it is the damn PBL that bit me. You are in the same boat as me. H910PR, H910, and H915 all have the same PBL. You bricked the same way I did :(

With that in mind I just realized that we can use the H915 KDZ to get the files we need. Specifically the 7 GPT partition layouts (I don't know how to pull those from a running phone).

I think we need the GPT for sde ... I think that is the "boot disk".

Biggest problem here is that we need help from people with running phones to get other information, and they seem hard to come by.
[LG V20 Guides, News, & Discussion] askermk2000:
Yes, well I meant that T-Mobile is extra secure. Before hardbricking I was battling that damned TMO Simlock crap. They seem to have gone very far to excel in locking, securing, whatnot, for whatever reason. Possibly T-Mobile is the only model with a unique PBL.

Yeah! we did it the same way, only reversed :)

Bootloader is spread across 2-3 or more disks.

Edit: You flashed with LGUP?
[LG V20 Guides, News, & Discussion] runningnak3d:
Yep, I flashed with LG UP.

Doing some more research since my last post, the sdcardlayout.txt file that mksdcard uses has all 7 GPT files in it, so yea, I can see the boot path being spread across multiple devices.

BTW ... I want aware of this, but we don't have an eMMC chip, we have a UFS chip. I heard UFS and didn't bother to do research, and just assumed it was a file system. Should never assume. A UFS 2.0 chip, electrically, is 7 devices. I think UFS 2.1 which is come with SD835 is even more -- yay!
[LG V20 Guides, News, & Discussion] askermk2000:
Yes our device is actually a SK Hynix 3D v2 MLC NAND UFS 2.1 chip.

Number of devices is 1-8, it's configured in firmware as per the wished of the customer.

Where is this *sdcardlayout.txt* file you mention? It does not sound like the ones I've seen.
[LG V20 Guides, News, & Discussion] runningnak3d:
I got the name wrong (been a long night)

From the link.

xbl,2048,,DEA0BA2C-CBDD-4805-B4F9-F428251C3E98,,xbl.elf
tz,2048,,A053AA7F-40B8-4B1C-BA08-2F68AC71A4F4,,tz.mbn
rpm,500,,098DF793-D712-413D-9D4E-89D711772228,,rpm.mbn
hyp,512,,E1A6A689-0C8D-4CC6-B4E8-55A4320FBD8A,,hyp.mbn
<snip>

I had hoped that was: "partition name, block size, GUID of the device that partition belongs on, name of the image for that partition"

We can get the GUID of each of our GPTs with gdisk:

gdisk PrimaryGPT_0.bin
GPT fdisk (gdisk) version 1.0.1

Partition table scan:
MBR: protective
BSD: not present
APM: not present
GPT: not present

Creating new GPT entries.

Command (? for help): p
Disk PrimaryGPT_0.bin: 48 sectors, 24.0 KiB
Logical sector size: 512 bytes
Disk identifier (GUID): D16BFDC4-9296-418D-B87D-63074F248BF4
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is 14
Partitions will be aligned on 2048-sector boundaries
Total free space is 0 sectors (0 bytes)

Number Start (sector) End (sector) Size Code Name

Command (? for help):

BUT -- if you look at that file, all the GUIDs are unique. *sigh*

-- Brian
[LG V20 Guides, News, & Discussion] askermk2000:
Yes, that is the same file I have used as template. It does not contain the PrimaryGPT-files though. It makes it's own GPT partition table and inserts the partitions listed in *sdrescue.txt*, in order.

It's not the unique GUID that's listed. It's the normal identifier GUID. Meaning it will be universal standardized GUID. LAF partition for example has a non-standard GUID made by lg (98523EC6-90FE-4C67-B50A-0FC59ED6F56D), since LAF stands for LG advanced flasher, or something to that effect.

You can get the missing GUID's from PrimaryGPT files, by reading in hex and converting the hex value: GUID Converter.

I can also post my .txt file with all the GUID's and all partitions listed in order, as if there where no separate LUNs (devices).

The filename is 990ds, but it contains mostly the same info we need, with a few extras only for 990ds.
[LG V20 Guides, News, & Discussion] askermk2000:
Ah ok, now I get what you meant. Yes it's not the GUID of the device. There will only be one device with an sdcard, AFAIK.

But, that does not mean it will not work.

I have already established that the PBL will find the XBL by it's GUID (that is how I make the phone respond the the card). Problem is that I don't have the full dump to test further, to check if XBL will continue the boot process.

Right now it looks like this: PBL -> XBL -> ??

There are two possibilities here, I think.

One is: XBL doesn't find the missing partitions, because I don't have them.

Two: XBL will not be able to locate the partitions, because they not on the designated LUNs, as they appear on the UFS NAND.

I'm hoping it's the first.
[LG V20 Guides, News, & Discussion] runningnak3d:
If you look at the XBL image, it looks like it goes something like this:

PBL -> XBL -> PBL -> XBL

That second XBL could be XBL2 as some sort of verification -- but that is weird, since we have an XBLBAK. All 4 are identical (xbl, xblbak, xbl2, xbl2bak).

Then the XBL loads:

ddr (got to figure out what LG called that partition)

pmic

devconfig

QHEE (no idea)

rpm

aboot

I *believe* that is all we need to get to download mode since it is contained in aboot, and it doesn't look like XBL does any further verification unless you want to continue the boot process.

Also -- this is promising (from XBL):

Boot Device: UFS
Boot Device: [B]eMMC[/B]
Boot Device: SPI
Unable to determine boot device ...

So eMMC IS in the boot order, and since you got some life out of yours with an SD card -- I now have hope that we can figure this out.

-- Brian
[LG V20 Guides, News, & Discussion] askermk2000:
DDR = DDR :)

QHEE = HYP

I found it here. You can see the GUID for QHEE there, I then searched for it in my txt-file, and it corresponded to HYP.

I know, it weird that xbl1 and 2 exactly the same. I did SHA256 checksum on both, and its the same.

They also have the same GUID. Hopefully this won't cause any problems for sd boot, since I can't think of any other way of identifying which is which, other than the fact they are on different LUN. XBL on lun1 XBL2 on lun2.

Though I don't know much about how partition tables work, maybe can lookup by name also.

DEVCONFIG = is probably DEVCFG

devcfg is in the kdz, so all we need is DDR in that case. Unless DEVCONFIG is DEVINFO, but I don't think so.
[LG V20 Guides, News, & Discussion] runningnak3d:
I only have a dump of the KDZ to go by -- tis why I didn't see DDR :)

We also need CDT, LAF, SDI, and SEC. and I am still digging.

-- Brian
[LG V20 Guides, News, & Discussion] askermk2000:
Ok, this is a while since this was posted.

Removed old attachment and added a new one, since it contains all the H918 partition, or nearly all. Might be useful for someone.
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=6814590]askermk2000[/MENTION] Well, I just found an excellent deal on eBay, so if no one else helps you before then, I will have an H918 next Tuesday. I still plan to try and recover my H910, but it is impossible to get anyone to help you around here anymore. I mean I asked for a simple dump of the modem firmware -- which can be done without even rebooting the phone, but nothing. I find it hard to believe that I was the only H910 rooted user on here.

I really hope you find a solution before then, but if not, I can guarantee we will get your phone fixed if it is possible with an SD card once I get mine.

-- Brian
[LG V20 Guides, News, & Discussion] askermk2000:
Great! :good:
[LG V20 Guides, News, & Discussion] dimm0k:
[MENTION=6814590]askermk2000[/MENTION] I feel bad about the misc partition for this device not just to you, but the community as a whole... anyway, I'm going to create a dump for you tonight if you still need, let me know and I'll free up some time to do this
[LG V20 Guides, News, & Discussion] askermk2000:
Yes, I still need it :)

Well that misc thing wasn't you fault, I'd say. Who would have though to look for faulty/wrong partitions within an official firmware release :confused:

There where some stuff in that kdz that where not supposed to be there. Like userdata and cache partitions.

Bad bad, LG.

Edit: I have sent a message to LG about this. I would think they'd like to know about it.
[LG V20 Guides, News, & Discussion] dimm0k:
unfortunately it looks like I cannot assist you in this... I just noticed your mention that you're looking for a non-10p updated phone, which I am currently on =( let me know if there's anything else I can do...

if you ever get your phone back to working condition, I believe I have figured out some of the locations via a hex editor to restore/modify the values for the misc partition
[LG V20 Guides, News, & Discussion] askermk2000:
Yeah, because I'd like the possibility for root :) I'd take a 10p dump if no one stepped up. But I'll wait some more, runningnak3d will help out in 5 days if no one will respond until then.

So you got a misc partition from someone? I guess we can both get that from runningnak3d's phone if no one else will assist.
[LG V20 Guides, News, & Discussion] dimm0k:
hopefully [MENTION=3167089]runningnak3d[/MENTION] can help! I'm learning as much as I can about the misc partition. the interesting thing is the partition itself is 32MB in size whereas the misc.bin from the KDZ is 512KB so in theory flashing the zip (not sure about the KDZ) should have only overwritten the first 512KB of the 32MB so we're not dealing with too much damage.
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=5687667]dimm0k[/MENTION] Just curious, what did you lose / what stopped working when you wiped the misc partition. It was my understanding that the misc partition was only used in conjunction with the stock recovery for things like OTA updates.

[MENTION=6814590]askermk2000[/MENTION] Have you verified that 10p does have an ARV of 1? If so, and you are on 0, then you definitely do not want to boot from that, and try to flash (it will either fail, or if you force it, it will blow the qfuse). If you want to test the SD card, it would be safe to boot from since it doesn't touch the UFS chip.

-- Brian
[LG V20 Guides, News, & Discussion] askermk2000:
10P is ARB 1 yes - that's for sure. Also booting a 10p bootloader, either from sdcard or internal storage doesn't matter. It's the booting itself that matters, not writing it to storage.

Because qfuses are in the cpu. It's actually physically damaged transistor's or something like that. Making them permanently fixed either on/off.
[LG V20 Guides, News, & Discussion] dimm0k:
the only thing I noticed being lost/broken was my WiFi MAC address. what happens when the misc partition is missing or wiped is your MAC address is generated with a generic one that begins with 00:90:4c. while this isn't that big of a deal, it becomes a hassle when my WiFi at work and home assign specific IP addresses based on MAC. the misc partition also contains information like the BT MAC address, IMEI, and serial number... these unique info I myself don't need or want, but if you do decide to provide this partition you should open up a hex editor and block these out for your own sake. not saying either of us needing this partition isn't trustworthy, but you never know. anyway you can find this info on your device in the the Settings > About Phone section... from there it's just a matter of searching for those strings and replacing them with something that stands out like "WIFI MAC Address here" so we know which position in the dump to change. sorry, but it's going to require some work on your part to protect yourself.

also to add on ARB, from my understanding the "boot stack" for a ROM triggers the ARB by causing something physically within the device's hardware to occur such that when this happens you're marked for life by ARB. at that point you can only go to the same level ARB or higher, never lower...