yashsingh1/xdaforums huggingface dataset:
[LG V20 Guides, News, & Discussion] runningnak3d:
Thanks for the info on the misc partition. I never noticed because I have never needed a fixed mac address (I assume it is generated on each boot if it is missing). As for the work needed, not a problem -- that is what this forum used to be about, people helping each other :)

As for the qfuse, I know it is in the CPU. There is an area that if written to with the proper voltage, it will physically damage the chip. But again, I thought this was only triggered if you you were attempting to flash. You are saying that the bootloader checks that ARB version on boot, and triggers the self destruct? That is just being a total **** (4 letters, starts with a D), POS, *** **** (two words, first starts with A, second H)....

Do these SOBs not know there is no difference between a cell phone, and a computer with a modem. The fact that the call / data goes over the air is irrelevant. There is no difference between this, and if IBM had decided to blow up the original PC if you installed something besides DOS. WTF?!?!? I am seriously getting irritated. There is NO REASON for this. They can claim that it is to protect their network blah blah blah. Fine. Make the MODEM have a qfuse, and keep the modem firmware separate from the OS so it is updated by the carrier, and only the carrier. Oh wait, this is already possible, but they have their hand so far down our pants that we have no choice but to bend over.

-- Brian
[LG V20 Guides, News, & Discussion] askermk2000:
Yes. I'm mostly extrapolating here, but I don't see how else it could be done. It just seems like only feasible explanation.

Otherwise you could update with TWRP without the drawbacks of ARB, I suppose. It would make for pretty poor "security", or whatever it is.
[LG V20 Guides, News, & Discussion] runningnak3d:
Found a great article on efuses here.

The juicy part:

Now that I know this, I am going to deliberately pop the qfuse on my H910 and send it back to LG. If they repair it, I will do it again, wash / rinse / repeat until they will no longer repair it. At that time, I will file a complaint with the FTC. I would LOVE to hear someone tell me how it is legal to physically damage something that I purchased just by installing an UNMODIFIED version of the OS that just happens to be older.

I seriously doubt that anything will come of it -- but it will give me a good laugh to hear someone explain how they feel it is justified.

-- Brian
[LG V20 Guides, News, & Discussion] TheMadScientist:
noticed you said you need a pull from a working device if u look in the lg g5 threads there is a modified lgup that can pull partitions from a working device.

You know id dump one if i had the device for ya.
[LG V20 Guides, News, & Discussion] askermk2000:
I don't think you could claim they're "damaging" the device. This is just a programming technique Qualcomm has implemented. I'm not a lawyer, but I think QC is free build chips this way.
[LG V20 Guides, News, & Discussion] askermk2000:
Yes I know. I also mentioned it in post #2

Seems I'll get a dump soon anyway. [MENTION=3167089]runningnak3d[/MENTION] has bought a H918
[LG V20 Guides, News, & Discussion] askermk2000:
Wait... are we on the same page here? The qfuses are meant to be "popped" each time you upgrade a firmware that is marked for it. It's doesn't do anything as far as we're concerned. *Unless* you mess around with TWRP or other things to force flash older firmware.
[LG V20 Guides, News, & Discussion] emdroidle:
That is an interesting chart, though I will note the V20 uses the MSM8996 so some things from that source may not apply. I'm unsurprised to learn it uses the type UUID to find SBL1, that is pretty reasonable. For the V20 though you're looking for XBL1 instead.

KDZ files include copies of all the GPTs. May need to extract an image of the whole disk (rather than partition/slice), then you need a program which will read the GPT out of a disk image instead of a whole disk. The next issue is simply adjusting the GPT to match the size of the SD card. This is quite doable.
[LG V20 Guides, News, & Discussion] DarkestSpawn:
I quick read this, so bare with me

I'm running NSS6.5 on 10k firmware for the H918. What do you need, also write out how to do it and I will get what you need. Pm me so we don't confuse people.
[LG V20 Guides, News, & Discussion] Prowler_gr:
Use my patched LGUP from thread, and use the [DUMP] option.
[LG V20 Guides, News, & Discussion] askermk2000:
I get the feeling from your comments about this, that you know something I don't :)

Do you think my method of using *mksdcard* (from DragonBoard tools) to generate a GPT image based on partition.txt input-file, will not work?

If so, why is that?

So far I know PBL is loading XBL. But it's uncertain what happens next. Is it missing partitions, or is it something to do with how the partitions are found...

PS: I will get a dump soon, so should be able to rule out "missing partitions" then. If it still doesn't then perhaps I could try to get UART output. Have you done this on the V20?

Edit: Has it something to do with LK and aboot ? Maybe lk needs to be compiled for this? Older models aboot would be, because sdcard and emmc is the same essentially. So we're back to what you said initially on github I suppose.

And there is no way to recompile aboot because it's signed, even if bootloader is unlocked, aboot is still verified. Correct?

I though what aboot did was load boot.img and stuff not related to bootloader, but maybe not.

Maybe I'm not making any sense :p
[LG V20 Guides, News, & Discussion] askermk2000:
I'm sorry I probably misunderstood something.

I do share you annoyance with this whole thing though. I am starting to think that it is impossible unbrick the H918 now. If the sdcard method doesn't work then the only way is to have the rsa key TMO used for signing, or the signed firehose itself.

Damn, why do they do such stupid things... I get the bootloader security thing, but if we had a working firehose, the only thing we could do is repair the phone(or at least, I think its all we could do?). Bootloader verification chain would still be in place.

I don't see the problem. Seems completely mindless bollocks.

PS: Well perhaps if we had the service manual, we could find the test points (if any) to enter download mode, like you mentioned in your thread a while back.

I think my next step will be to disassemble the phone, de-solder the "shield" covering the SoC and take some detailed pictures of the whole board. Maybe someone here can make use of it, perhaps figure out the test points.

But to be honest, I'm almost afraid to do that. With my experience here, it seems reasonable to assume that removing this cover will trigger a self-destruct of the chip or something :p
[LG V20 Guides, News, & Discussion] runningnak3d:
Well don't do anything drastic till Tuesday :P

Did you get a full dump from an H918, or are you still working with pieces from other models?

As for the test points. There USED to be test points to put a Qualcomm chip into 9008 mode (don't need those obviously), and 9006 mode. In 9006 mode, the eMMC was visible when connected to a PC over USB, so you could just flash the individual partitions just like you would an SD card. Now that they are using UFS chips, I don't know if those points will even exist.

EDIT: actually if you go back far enough, you used to be able to send a command to the phone when in 9008 mode to put it in 9006 mode.

-- Brian
[LG V20 Guides, News, & Discussion] askermk2000:
I found a yt video about the V10. He show how to put it in 9006 mode. Since V10 is the last model behind V20 it doesn't seem like a stretch to assume it would also work for V20.

Bet then, this Snapdragon 820 is like the start of a new era in the mobile soc industry. So who knows...

I have a full dump now, but I haven't gotten around to test it yet. It's way past midnight here now, so will tomorrow.
[LG V20 Guides, News, & Discussion] emdroidle:
I tend to worry more about ESD than a deliberate self-destruct mechanism. If you do this could you try to figure out where the pins on the back of the phone go? We obviously know about the pair used for the NFC antenna, but the rest are a mystery. Obvious speculation is at least two are hooked up for a wireless charging back, but LG had problems making such a back at an appropriate price. Knowing which two are hooked up could allow one to make a functioning wireless charging back.

Quite likely, I know a lot of things. :) Problem is figuring out which ones are of value to you. I did some heavy disassembling of the KDZ format a while ago (hoping to make an altered one, no dice). Pretty decent rule is anything which has both a "<name>" and "<name>bak" partition is part of the bootloader, or bootloader-related. At a guess it might be as simple as just copying all those areas to a SD card with a single GPT and partitions matching the sizes of all of them.

What I wonder about is why there are "bak" areas for the bootloader portions, yet there is no evidence they ever get used. If the primary area gets damaged you tend to be bricked and the backup doesn't do anything.

Nope, I'd love to get to the console UART. 3 spots occur to me as likely locations for the UART: headphone jack is common, perhaps some of the extra USB-C pins are used in an odd way (I'm thinking something along the lines of how Power Over Ethernet works), perhaps those pins which touch the back have it.

If aboot isn't verified then there is a pretty darn big hole in LG's Android security. aboot does a fair bit more than merely loading boot, it has been shown it also initializes portions of the display and memory areas related to the modem. This is why there is the static screen issue with DirtySanta (incorrectly initialized display chip); and lead to the H990 needing some adjustments to magical memory regions to get the modem functioning.
[LG V20 Guides, News, & Discussion] andy_zhang:
Oh, my God. Bad LG, why do they close the qpst

file? It makes people crazy
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=6814590]askermk2000[/MENTION] My H918 is out for delivery. Got here early ..
[LG V20 Guides, News, & Discussion] askermk2000:
I have now tried this to my satisfaction. Sd card booting will not work. emdroidle's initial assessment was correct. Oops, in fact it was [MENTION=3167089]runningnak3d[/MENTION] 's assessment I was referring to. From this thread.

Since the bootloader is not compiled with booting from emmc/sdcard in mind, we can't get anywhere with sdcard.

When I first started this I did not understand some of the intricacies I now do, sd booting worked before only because sd and emmc are practically the same media. Not so anymore, with ufs used instead of emmc.

The primary bootloader will initialize the boot process, even from sdcard, but it stops right there. Since secondary bootloader can't work from sdcard.

I did kind of understand this, but finding out about DragonBoard 820c and it's sd-rescue got my hopes up. It says you need to recompile the bootloader, but hey, I thought maybe you don't need that with most phones since sd booting has been done before so many times. But then we're back at the sd/emmc thing again... I did not connect those dots at the time.

A bit too much information on a new subject I suppose.

This is my conclusion. Sorry if I got any hopes too high.

A small caveat here: I can't be 100% sure if it's totally *impossible*. I'm not really the best person to investigate this.
[LG V20 Guides, News, & Discussion] runningnak3d:
Yep -- makes sense. I had hoped like you that there was a CHANCE that they had compiled in support -- especially finding SD card in the boot list for the xbl. But I am sure that is just a menu, but the underlying code is not there to support it.

Do you know if your phone is still under warranty? If so, then if I were you, I would ship it to LG and no just rip it apart to understand the board.

-- Brian
[LG V20 Guides, News, & Discussion] dimm0k:
damn, real bummer... I was hoping you would have been able to get things going! I hope to see you back in the game with a replacement LGV20...
[LG V20 Guides, News, & Discussion] askermk2000:
No, warranty doesn't apply to me since I bought used from eBay, and I live in Europe.

I've been in contact with the major LG repair center here in Scandinavia, and they cannot repair it, with or without warranty. They said they'd contact someone in the UK, to see if there was a solution there. But apparently not, since it's been too long now without any response.

I can console myself with the fact that it only cost me $135 + shipping. And maybe a solution will surface eventually, or I can find someone in Europe who does JTAG repair services.

Edit: I have sent a "VoC" to LG. I suggested they release a recompiled bootloader that can boot from SD-Card, and that it would be HUGE, a real boost the their image in the open-source community.

As I wrote: "Nobody likes to have a volatile device that could simply die whenever, with no way to fix it."
[LG V20 Guides, News, & Discussion] andy_zhang:
Come to China. Alibaba, they'll fix it. [emoji1] [emoji1] [emoji1] [emoji1]

China user
[LG V20 Guides, News, & Discussion] askermk2000:
Do you think we should use the gpt exactly as it's on the UFS?

This is the original "disk" GUID: 98101B32-BBE2-4BF2-A06E-2BB33D000C20

Searching for this shows that it is commonly used in smartphones. All the different LUNs use the same.

The image made by mksdcard sets a different one. How can I change it?

I tried to change it directly by hex editing, that was unsuccessful.
[LG V20 Guides, News, & Discussion] emdroidle:
There are CRCs in there. GPT is documented on page 195 of the UEFI specification. The disk UUID isn't too likely to make much difference, most likely the important part would be to preserve the partition type UUIDs and match the sizes. From what I've read, it is quite likely the id UUIDs are ignored (but preserving them is unlikely to hurt). Using `parted` or another GPT editing tool is your best bet.
[LG V20 Guides, News, & Discussion] andy_zhang:
Ho w to write rawprogram. Xml

China user
[LG V20 Guides, News, & Discussion] vn_mobile:
Need Unbrick your V20 contact me for check...
[LG V20 Guides, News, & Discussion] askermk2000:
I would look at, say Oneplus 3 or similar device files, and try to adapt it for V20.

That is if no one else a better explanation.
[LG V20 Guides, News, & Discussion] askermk2000:
Here are some pictures of the mainboard.

I was going to remove the shield from the soc (I assume the ufs is also under there), but it was more difficult than I initially thought.

I would need some serious heat to remove that since it is very good at dissipating what I've used so far. After a while I left it alone. Maybe try again later if there seems to be a need for it.

Picture 1

Picture 2

[MENTION=6984210]emdroidle[/MENTION]

You mean using the size values as they appear in PrimaryGPT* ? Those sizes are smaller than the corresponding partitions.

I've tried to use simply a random/larger size, and I've tried using the same size (rounded in KB).

But then, I'm not really the best at doing this sort of work.

If it even is possible.
[LG V20 Guides, News, & Discussion] andy_zhang:
Do you know how to extract Qpst files? If you can find such a tool, you can.

China user
[LG V20 Guides, News, & Discussion] askermk2000:
I forgot to check this out when I had it open. I will see if I'll open it again. Though as I remember most IC's are hidden away under fully soldered shields. So not sure if I'll be able to make any meaningful traces.

I have ordered some cheap ebay usb-uart thingy. I'll see if I can detect uart somewhere. Though for a running phone, doesn't LG use resistors on usb ground - id pin to enable it? Have you looked into that?
[LG V20 Guides, News, & Discussion] Denversmartphone:
Guys maybe i found a solution for the hard brick lg g6-g5-v20 but need a person very very good with linux after talk with a cousin of my friend work on qualcomm explane me a lot of stuff...doesn't give any file or anythink but tell me the solution is more easy than what we think.. give me a link of all qualcomm motherboard android.. and is in this link:

https://wiki.codeaurora.org/xwiki/bin/QAEP/release

and after a pdf to download where explane how to get the file to work with it...or maybe download the right think or understanding how can create android with qualcomm...im not good in script terminal or think...actualy i didn't understand nothink but my brother is informatic at first years of university and say that can be a good way if you know what to do

Link to qualcomm android pdf: https://developer.qualcomm.com/downl...tion-guide.pdf
[LG V20 Guides, News, & Discussion] Phoenix591:
Your second link is broken, and unfortunately while codeaurora does provide important pieces that are used to make custom ROMs and kernels, it doesn't help a lot with a broken bootloader: while with some code made by codeaurora its possible to compile the pieces of the bootloader, the bootloader itself is checked to make sure it's from LG even when the bootloader is unlocked (then it stops checking the parts of the boot process after it).
[LG V20 Guides, News, & Discussion] Denversmartphone:
this process i mean is not for root this process is intended to download customize e use a firehose emmc that allow you to recostruct your smartphone after a hard brick, with this process you can download original file from specific android motherboard..you don't have to build the entire android smartphone OS but you have to take care only about emmc, because the boot laf recovery we have already and we can extract from kdz..if a person know how to do it all this process we can do somethink and one time we have the emmc firehose for specific qualcome we can create a raw.xml and patch.xml and make out from hard brick all the smartphone qualcomm locked to it..the second link is a pdf from qualcomm with all instruction for building all this stuff included all secret command qualcomm for the fastboot adb. If someone is interested send me a private message and will give this pdf...
[LG V20 Guides, News, & Discussion] Phoenix591:
All you have to do to fix the second link is edit your post... It just has a ... Instead of part of the URL.
[LG V20 Guides, News, & Discussion] Denversmartphone:
this is the pdf file
[LG V20 Guides, News, & Discussion] pyrorob:
Almost all the commands in that PDF are ones that any good multi function utility app does ie; trickster mod, device control, kernel auditor, etc. Nothing there's as far as I can see that concerns unbricking in any way..
[LG V20 Guides, News, & Discussion] Denversmartphone:
clear! i do my best :( btw i really pissed off and i write to lg and i say that if they will not release emmc firehose for lg, all lg user will pass to huawei p20 because all people are tired of his locked motherboard xD we give a try maybe this is the latest solution xD i think they care about client..if they don't sell production they will not eat xD after all in 2018 they are not the only one there are outside 2000 smartphone bettern then lg..so is better lg start to understand client and give soddisfaction..first of all because they really have a bad assistance..in italy for sure...also if you have waranty and you don't really do nothing..they find 1000 excuse to don't give you a waranty repair
[LG V20 Guides, News, & Discussion] Denversmartphone:
ok i found the msn8996 for lg g6-g5-v20 but is like nobody want to help and actualy look nobody want to really unbrick this phone..maybe there is a profit back to this..btw i have the msn8996 firehose file..but the problem is that is on elf format..after all we need someone can create patch and partition xml for make it repair in qfil...if someone is able to do and want to help me im here..i try to do the best for save some smartphone that we love to use..
[LG V20 Guides, News, & Discussion] askermk2000:
There is no such thing.

For V20 there is at least two different ones; one for the T-Mobile H918, and one for the rest.

We already have a firehose, it's the non-h918 one, and it's dangerous to use since it will permanently ruin your phone.

Now, since I looked back in summer last year there may have leaked some new firehoses, but likely you have the same we already have, or

you simply have a firehose for another phone with msm8996 which will not work on these LG phones.
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=6814590]askermk2000[/MENTION] Actually we don't know yet what the ramifications of using the V20 firehose are. I have a lot of speculations based on looking at the code, but we haven't found someone brave enough to use it yet.

[MENTION=9043921]Denversmartphone[/MENTION] post a link to your firehose and I will check and see if it is signed for the H872. If it is, I will be glad to provide you the XML file that you need to use with QFIL. If it isn't signed, or isn't signed for the H872, it will not work.

EDIT: Also, it is now definitive that the V20 can not boot from SD card. It is possible to change the boot LUN, but not the full boot path. So, you can boot from /dev/block/sda (the default) or sdb, sdc, etc.

Booting from /dev/block/mmcblk0 is not possible.

-- Brian
[LG V20 Guides, News, & Discussion] Denversmartphone:
https://wetransfer.com/downloads/bb...load_button&utm_source=notify_recipient_email
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=9043921]Denversmartphone[/MENTION] That is signed with Xiaomi's Root CA. It will not work on ANY LG phone, G6 or otherwise. Best case scenario, it just doesn't work, but worse case is that you brick your phone even worse than it is now.

It isn't known what happens if you use a firehose that is signed with a different cert than what matches the key in your CPU other than the fact it flat out will not work.

-- Brian
[LG V20 Guides, News, & Discussion] askermk2000:
[MENTION=3167089]runningnak3d[/MENTION]

I ended up trying quite a few programs and firehoses on my h918. I used qfil, qsaharaserver, fh_loader etc. the firehoses would simply not upload.

There was some error messages with no clear indication, but it seemed like nothing was initiated or changed during my attempts.
[LG V20 Guides, News, & Discussion] Denversmartphone:
actualy i think will not happens nothing...we are testing now with a guy from gsm group, you just failed but we try different combination with lg g4 xml but programm will not let you to flag the cpu..it's just show as fail and stop..if you have the correct file the phone will work again normaly..i think at this point the best solution is to make a full copy file of a working smartphone..btw i have a smartphone so i will let my lg sleep..when somethink come out i will unbrick without any problem..for the moment i am safe...my next smartphone for sure will not be lg..because is everythink hard to repair in case of hard brick..
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=6814590]askermk2000[/MENTION] good to know! Now we just need a brave LS997 (I say LS997 because they are the only V20 users that currently can't root, AND the firehose will work with) user to test the firehose that we have to see what blowing the debug fuse ACTUALLY does to the phone ;)

-- Brian
[LG V20 Guides, News, & Discussion] cnjax:
Of course if you didn't do unwise stuff with your phone it wouldn't be bricked. Js
[LG V20 Guides, News, & Discussion] anotherdj:
I volunteer :) Count me in.

Got an LS997 cheaply, so I can risk bricking it.
[LG V20 Guides, News, & Discussion] Alcolmena:
Please let us know of any progress on this matter. I know there are tons of people out there with a hard bricked V20. In my case it is a H915 hard bricked after an attempt to go from US996 to H918. Huge mistake!! I guess it was too late at night when I decided to go on that road. 100% installed but it never woke up again. Just giving me the "Qualcomm HS-USB QDLoader 9008" under Device Manager.

As someone said over here. Let's put the V20 to sleep for a while to see if something magical happens.
[LG V20 Guides, News, & Discussion] runningnak3d:
Send me a PM with a good time EDT that you can be on IRC. I will talk you through using the firehose.
[LG V20 Guides, News, & Discussion] suriya111:
cheers up to you, hope to work done.