yashsingh1/xdaforums huggingface dataset:
[LG V20 Guides, News, & Discussion] runningnak3d:
So, I know I haven't posted much the past couple of weeks -- had a family emergency and I just went off the grid. Things are starting to kind of get back to normal, so I will be back around more.

While I was away, I dropped my phone and got a crack in the screen, so I picked up another H918 off of eBay (freaking $120 mint condition with shipping -- that is insane).

Anyway, it came with 10r which of course doesn't have the COPY opcode, so I needed to do some flashing to root it. I flashed 10p, but before I rooted it, I wanted to run some tests.

It turns out I was WRONG about a major assumption (all laf is created equally across models -- as in H910 10p laf is the same as H918 10p laf).

I am sticking by my "I am not releasing anything else until we get freaking Oreo", but I wanted to at least say this was a MAJOR breakthrough.

Right now, with the exception of the LS997, all V20s can be rooted. I would really like to give the LS997 guys some help -- but if I do not want to delay Oreo anymore.

With that said, this a REALLY cool, and I really want to post all the details about it -- going to have to cut off the beer so that I don't. :)

Suffice it to say, LG are idiots. I am sure Samsung is too, but I have no desire to have a Samsung phone. As a matter of fact, I will be keeping a V20 until SOMEONE releases a flagship phone with:

* removable battery

* SD card

* Headphone jack

* IR blaster

In other words, take a V20, drop in an SD845 with 8gigs RAM, and upgrade the camera (and the upgraded camera is optional).

-- Brian
[LG V20 Guides, News, & Discussion] androiddiego:
Great news! Happy Father's Day to all! Thanks Brian!
[LG V20 Guides, News, & Discussion] goldybewon:
Thanks..(:)

Dear-- Brian

You did a fabulous job for us.

Keep it up...Have some...B

Confirmation number: 6R217453GU701724V

Thanks for sharing goodies.

Thanks,

g@ldybew@n
[LG V20 Guides, News, & Discussion] dvckbiz:
It's nice that you've come back. But I would be happy if LS997 is not an exception :(
[LG V20 Guides, News, & Discussion] Zacharee1:
*POOF* it's not an exception.

(It's not that simple ^)
[LG V20 Guides, News, & Discussion] runningnak3d:
So in today's news we have -- laf root shell for almost all V20s:

First normal laf

./lglaf.py
LGLAF.py by Peter Wu (https://lekensteyn.nl/lglaf)
Type a shell command to execute or "exit" to leave.
# whoami
Hello, I am LAF. Nice to meet you.#
#

As I stated before, normal laf has a very limited list of commands that execvp will allow. If you try and run a command that isn't on that whitelist, you get: "Hello, I am LAF. Nice to meet you."

Now let's replace that laf:

./partitions.py --restore patched-laf.img laf
[ 100 % ] 2018-06-20 13:50:27,343 partitions: INFO: Done after writing 50331648 bytes from patched-laf.img

Now notice, this is using --restore which is the normal KDZ flashing method. The SIGN payload gets sent, and then WRTE opcodes are used. This isn't using MISC WRTE / COPY, so ANY laf version can flash it onto any device.

Once sent the hash is compared, and if it matches, it flushes the buffer to NAND.

So what do we get now:

./lglaf.py
LGLAF.py by Peter Wu (https://lekensteyn.nl/lglaf)
Type a shell command to execute or "exit" to leave.
# whoami
root
# uptime
18:09:19 up 0 min, 0 users, load average: 2.11, 0.50, 0.17

So now we just slap TWRP and a few other files onto an SD card, and use dd to flash it onto recovery, and unlock the bootloader.

Now, why is this important? Well right now it isn't. Even with this breakthrough the LS997 still can't be rooted on ARB 1 since there are no ARB 1 aboot images that can be unlocked (it is pulled from the stock LS997 aboot), and the engineering aboot is also ARB 0.

However, if Oreo comes out and they increment ARB, and Oreo won't boot on older firmware, anyone without an H918 will have to choose between Nougat and root, or Oreo and no root. We need a third option ... and this is it :)

I am posting this because there is nothing Qualcomm, LG or anyone else can do about it since it uses standard KDZ flashing (well -- I guess they could remove download mode completely -- but they won't) They can modify the protocol, but I will just reverse engineer the modifications. It is a cat and mouse game that they will always lose.

I will be pushing the code and the image to my repo. Again, it really doesn't do anyone any good right now -- but it will be out there.

What I am NOT releasing is the part that will have LG scratching their heads. How did I get a modified image to flash AND pass the hash check? If I can modify an image, why not just modify TWRP and flash that directly?

Those questions will never be answered publicly.

-- Brian
[LG V20 Guides, News, & Discussion] tomc585:
I wish i had the talent....and the patients to contribute. I love my LS997 for the same reasons

* removable battery

* SD card

* Headphone jack

* IR blaster

I just cant stand the fact it wont MMS over wifi (the main reason i need to root)
[LG V20 Guides, News, & Discussion] christopherrrg:
Is patched LAF specifically for v20? Or could I use this information to mod the G6 LAF to have those commands?

I also apologize. I know I'm eager and ask for quite a bit but there isn't many people to bounce ideas off of for the G6 as anyone who cares for root generally bought the US997 and H870. Sadly myself could not afford unlocked at the time.
[LG V20 Guides, News, & Discussion] runningnak3d:
The V20 laf works on the G6, so yes this image would work.

-- Brian
[LG V20 Guides, News, & Discussion] christopherrrg:
You're amazing, thanks!
[LG V20 Guides, News, & Discussion] christopherrrg:
No matter which command I do I get this. I know you'll notice me using my own distro but I also attempted it with FWUL and it's giving me the same errors. Which now leads me to believe it's my device. I'm on oreo H873 first leaked kdz. Do you think this makes a difference? It's also ARB 0.

Is this the right place for this kind of discussion? I'm not entirely sure if this is LAF giving me an issue or my python, pyusb, cryptography installations. So I wanted to mention that and get the ball rolling with a bit of discussion.

Edit - ignore first error that was because my device was not connected.
[LG V20 Guides, News, & Discussion] runningnak3d:
I haven't pushed the updated code with the image to my repo yet.

Right now the SIGN payload is hard coded, and there are other bits and pieces I am cleaning up.

When I get to work I will push what I have if you want to play with it.

If you have an 873 a root shell won't do you much good until I release the aboot unlock, and that isn't coming until Oreo gets here.

I will discuss things that flat out can't be patched, but not things that can .. no reason to give LG ideas.

-- Brian
[LG V20 Guides, News, & Discussion] christopherrrg:
My horses are definitely on hold; this community can't thank you enough.
[LG V20 Guides, News, & Discussion] Josh McGrath:
[MENTION=3167089]runningnak3d[/MENTION]

When you say that LAF is the same across the board, does that mean also the v30 ?
[LG V20 Guides, News, & Discussion] runningnak3d:
lafd .. yes, but the laf boot image is not.

When I said the same across the board, I was referring to the V20. The G6 just happens to also be able to boot V20 kernels.

I know you want root for the H932, and I have a method that works, that has nothing to do with laf, but I'm sorry, I don't own a V30, and that is my backup to my backup root method in case LG gets anal.

The fact that we have to fight with this is just horsesh!t. It isn't LGs fault though .. it is 100% on the carriers and don't let anyone tell you otherwise.

Do you know why you can't get a Exynos based phone in the US? Because there is no way lock the bootloader on those chips. US carriers demand Snapdragon based phones.

People will try and say it is because the Exynos modem doesn't support CDMA, but that is .. wait for it .. horsesh!t. They don't support CDMA, but there is no reason AT&T, or T-Mobile couldn't have them.

-- Brian
[LG V20 Guides, News, & Discussion] t436h05t:
Hi Brian, Do you still plan to release the H932 root process. Just wanted to know if I should wait or jump ship to a different phone. I completely understand if you do not plan to release the method as it's always a good idea to keep a backdoor case things get messed up. As it could help you to find other root processes. Anyways thank you for all your hard work. Keep the good fight going.
[LG V20 Guides, News, & Discussion] mattgyver:
He's stated before that his plan would be to release his stuff once lg pushes Oreo for the v20. Those of us with the H932 will just have to wait. The timeframe isn't set anywhere, so it could honestly be a while.
[LG V20 Guides, News, & Discussion] runningnak3d:
The current time frame is September, but it has been pushed before.

I have a H932 that can't make phone calls, and I am still looking for a method that can be used that is either exclusive to the V30, or can't be patched and works on the V30. I make no promises though.

I could be wrong, and LG is just so effing inept that they can't release an OS in a timely manner, or they are just super d**ks and won't. However, if there is a chance that they keep pushing the date due to their leaky security, I don't want to contribute to further delays by having then go: "Doh! We were dumbasses and didn't think of that. Now we have to patch THAT too"

-- Brian
[LG V20 Guides, News, & Discussion] Josh McGrath:
Oh I definitely wasn't rushing you about it. I just needed clarification is all. I'm actually glad for the wait personally for other reasons.

But I do have one question, the cat and mouse game. So you don't want to release the methods, and I agree %100 pct on this policy, but can't they just root via your method and reverse engineer that to find out?

I have a feeling that LGs security team is a fraction of what it should be. To quote JCase, "LGs security is -BAD-"

Oh and I am with you about LG being complet idiots about updates. It's like they abandon their year old devices by about 99pct. There's no excuse for releasing updates that are 3 months old, much less an updated OS THATS ALMOST OUTDATED ALREADY! (No Oreo when Android P is released)
[LG V20 Guides, News, & Discussion] steadfasterX:
Is that the phone with the leaked aboot file? If yes ping me on IRC!

.

of course and that's that is the reason why not releasing it earlier because they will reverse engineer and will provide a patch.
[LG V20 Guides, News, & Discussion] xXCoolGuYXx:
Fingered it out all you have to do I flash this file in TWRP and you have it back.
[LG V20 Guides, News, & Discussion] iodroid95:
Me to lol
[LG V20 Guides, News, & Discussion] BROKEN1981:
How come you still don't have that Dev tag? Dude you just owned the crap out of LG
[LG V20 Guides, News, & Discussion] TheDannemand:
This!
[LG V20 Guides, News, & Discussion] mattgyver:
This sounds promising, [MENTION=3167089]runningnak3d[/MENTION]!

If it's on the internet, it HAS to be true, right, Brian? :silly:: https://www.trustedreviews.com/news/lg-g5-v20-android-8-0-oreo-3502094
[LG V20 Guides, News, & Discussion] christopherrrg:
We G6 users got our first OTA since 8.0 (about 4 or 5 days ago) and it rebranded to ThinQ so maybe it's not too far off. *fingers crossed*

(Didn't update as I don't want to increase ARB but there's a few posts about it.)

Did LG plan on rebranding the v20 like the v30?
[LG V20 Guides, News, & Discussion] iodroid95:
Cheesy cheese that chesses when the chesse is chessed

I bet ya it was cheezy, was not it ?
[LG V20 Guides, News, & Discussion] christopherrrg:
I think the majority of us are waiting for an update from the dev when oreo pops.

Did you just post that to bump this thread again? I get you want your phone rooted, I've wanted mine rooted since the day it was out. Just have some patience.
[LG V20 Guides, News, & Discussion] Wiebenor:
So... i have 2 of these phones, or specifically I have 1 phone in my possession and am getting another... both cost 50$, or 25$ apiece... this phone is the ls997zva model/software version, and im not sure what the other one is on for software, but probably the same... so... I've read the 1st 2 pages, and then decided to just go to the end to see how development is right now... that said, I have to ask... how close are you to getting root??? I wanna replace my bootloader with TWRP, do a backup, and then put RR on it...
[LG V20 Guides, News, & Discussion] Gamesoul Master:
When the V20 gets Oreo. That's what we're waiting on.
[LG V20 Guides, News, & Discussion] Wiebenor:
Thanks... here's another possibly noobish question...

Yes... just read that on page 114, when I got buzzed about your message... but that in turn, brings up another question... if I'm on ZVA build, do I update, or do I not??? Id like to, if the patches after December 2017 are worth it, but not if they break this method of root and/or downgrade and/or replacing with custom software like resurrection remix...
[LG V20 Guides, News, & Discussion] cnjax:
Last I read the 997 can't be rooted, I believe runningnak3d said it has qfuses which would be blown
[LG V20 Guides, News, & Discussion] Wiebenor:
Said something like that in the first couple of pages... not sure what that is, but I hope it's been workarounded...
[LG V20 Guides, News, & Discussion] Gamesoul Master:
Last I heard, updating shouldn't hurt at all, since it'll still leave you at ARB0. But to be honest, I haven't seen any compelling reason to update.
[LG V20 Guides, News, & Discussion] TheDannemand:
We confirmed that Oreo updates are ARB0 on V30, but my understanding from reading earlier in this thread was that V20 is already ARB1 on Nougat. I could be wrong...
[LG V20 Guides, News, & Discussion] Zacharee1:
It depends on which variant.
[LG V20 Guides, News, & Discussion] Rukbat:
Nah, no pressure (as difficult as it is to run unrooted after being on a rooted phone for so long).

This may sound very newbish, but after years of Samsung, I guess I am a newb when it comes to LG. All the root threads I've read on the V20 call for installing TWRP first. Is it possible to install TWRP on an unrooted V20 (I've been running Safestrap on a Note 3 for years) and will doing so wipe anything other than the stock recovery (which the TWRP app claims it can back up)? Because if I can do it safely, TWRP is going on this phone and it's getting backed up today. I don't feel right with an un-backed-up phone.

And Shirazakm not 10 times an hour - December would be fine with me. Even January. Figuring our how to just install one lousy little file om a [hone designed to not let you do that - by just reading packets going in and out of the phone, no less - isn't an easy job. I've done it on data I generated my self, and even knowing the data that the computer is sending, it's not all that easy to read Wireshark dumps. So since I'm not able to do anything but test what's been posted (at 75, and out of the code business for over 5 years, I wouldn't trust myself - but that doesn't mean that I like running Linux without su), I'm content to wait. And I'll be very grateful to Largo, or whoever else does it, if/when we get root.
[LG V20 Guides, News, & Discussion] runningnak3d:
You can install TWRP without root as long as your bootloader is unlocked.

As for progress, there is just something that I am missing. Even if I send the EXACT opcodes but with the hash of the image I am sending, the write fails.

And as I typed this, I just thought of something. I haven't tried sending the stock image, with literally the exact opcodes. Tis good to type out some thoughts once in awhile :)

Thanks!

-- Brian
[LG V20 Guides, News, & Discussion] Rukbat:
My wife (who didn't know 8080 assembler from Forth), was my best debugger. If I had to explain it to her (she listened, but didn't really hear anything), I'd sometimes see what I was missing.

Unlock the bootloader to install TWRP, huh? I want to install it to back up the current setup. Maybe LG Bridge will back everything up? I sure hope so.
[LG V20 Guides, News, & Discussion] CrackedTech:
Seconded, the number of times I've fixed an issue just cause I explained it to the wife and that jogged something loose in my head or she made some crazy and/or obvious comment which clicked the whole thing into place is crazy. Rubber duck debugging man, lol.

Anyway, thanks for all of the hours and effort you've been putting in on this Brian!
[LG V20 Guides, News, & Discussion] Rukbat:
We can't say that enough, [MENTION=2463935]CrackedTech[/MENTION].

Still one problem, though - the TWRP app can't find the recovery - because the phone isn't rooted. So I can't back up the recovery in case the TWRP installation fails. I guess I'll just have to wait for Brian to come up with a stroke of genius.
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=4497155]Rukbat[/MENTION] Grab the patched LG UP here and you can use DUMP to back up your phone.

You will need 64 gigs of space no matter how much data you have on your phone because when it dumps the userdata partition, it dumps empty space as well.

That is the most complete backup of your phone that you can do. Later on, if you want to restore it, you will need to have your phone rooted.

-- Brian
[LG V20 Guides, News, & Discussion] Rukbat:
1. Thank you.

2. Thank you in advance (of coming up with a rooting method for 10q). :)
[LG V20 Guides, News, & Discussion] pbedard:
Dont wanna sound like a cheesehead but i wooulndt bother with this device. Sorry
[LG V20 Guides, News, & Discussion] Rukbat:
[MENTION=2792898]pbedard[/MENTION], I'm beginning to feel the same way, and not just because of the problem of rooting it. But I want a removable battery and an SD card, so what else is there? If Samsung had made the battery in the Note 8 or 9, I'd have gotten an 8, or waited for a 9. But I think LG is the last holdout.
[LG V20 Guides, News, & Discussion] sewalk927@gmail.com:
Didn't the removable battery go away with the V30? I held onto my Note 4 for as long as I could but I couldn't pass up the clearance deals on the V20 last month; I got the last one at my local T-Mo store.
[LG V20 Guides, News, & Discussion] pbedard:
Yes zte is one of the only few with removable battery
[LG V20 Guides, News, & Discussion] dricacho:
I have an LS997 ZV7 (5/1/17 security patch) you can test with. I have my good ol' Galaxy S5 I can use for the time being.
[LG V20 Guides, News, & Discussion] Rukbat:
Someone tell me why I'm crazy (these two thoughts just came to me as I was falling asleep last night - I go nuts when I'm forced to use an unrooted phone), but:

1. If we adb a copy of su to a user area, chmod it to 777, it should run, right? Giving us temporary root? Allowing us to copy it to bin (or wherever), giving us permanent root?

or

2. We read all of the user partition to a PC running Linux, cp su to where it belongs, then write the partition back? (Or can't we do that without root?)
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=4497155]Rukbat[/MENTION] Binaries on Linux run in the security context of the owner (without SELinux) and the security context of the policy assigned to the binary, directory, filesystem, etc if using SELinux (which Android does), so no, can't just copy su and run it :)

[MENTION=3035710]dricacho[/MENTION] You can root ZV7 without the need of this. I made a post around here somewhere with the procedure.

So, I haven't been able to flash the stock images by sending the exact opcodes as captured.

After several more dumps and doing a comparison, LG has just made this extra hard. There is some algorithm that generates a key that gets executed EACH time you need to send a restricted command opcode. So, I am going to have to go back and decompile LG UP, the DLL, and lafd again.

Basically it goes like this (it is challenge / response -- KILO CENT and KILO METR):

* LG UP sends an opcode to lafd to request access with a unique token that is generated SOMEHOW using an algorithm that is in the DLL

* lafd replies with some sort of token using some unknown algorithm generated with the token from LG UP

* LG UP sends an opcode with a new key that is generated based on the token sent by lafd

* lafd replies with success or failure

* If successful lafd will now allow restricted commands

* LG UP can now OPEN and WRTE to that file descriptor

All of this could be overcome by someone with actual reverse engineering skills in both x86_64 and aarch64, but I am an amature. Also, it is easy (easy being a relative term) to step through the code with iDA in Windows, but you kinda need to be able to do the same thing with lafd -- and that just isn't possible since it would require running a debugger within the LAF environment.

There is a static key that is in the DLL that you must use just to get lafd to talk to you at all.

It is easy to get into LAF and run the handful of unrestricted commands (ls, ps, lsof, dmesg, lsmod, and maybe a few others), and it is easy enough to READ (just need to send the static key, and a HELO with the correct version), but if you want to flash -- ehhhhhh -- LG gives you the middle finger.

I am stepping away from this for a while, it has frustrated me to no end.

-- Brian
[LG V20 Guides, News, & Discussion] dricacho:
OH!!! Sweet, I'll search for this, thanks. :D
[LG V20 Guides, News, & Discussion] tuxuser:
You all are aware that a major portion of RE was already done, right?

Github[.]com/Lekensteyn/lglaf

Fork with Challenge Response: github[.]com/steadfasterX/lglaf
[LG V20 Guides, News, & Discussion] runningnak3d:
Thanks for the link, but that is the challenge / response that lafd needs just to start talking using the static key.

Also, with the new versions of lafd, you can't just run sh and execute an arbitrary command. If so, this thread wouldn't even exist -- copy images to SD card, EXEC 0000 sh dd if=/sdcard/blah of=/dev/block/sdXX (it was actually quite easy with older versions of lafd).

Now, all flashing must be down using the WRTE opcode. In order to OPEN a file descriptor for write on a protected partition, you have to use the unknown algorithm to send a second challenge / response. Then once you issue a CLSE, you have to issue additional KILO CENT / KILO METR challenge / response for each new OPEN.

-- Brian
[LG V20 Guides, News, & Discussion] Giminji:
Come on back guys! When I pay this trashy 3 month old security updated phone I will go to a root friendly company. Until then, crack the v20! I'm cheering for you!
[LG V20 Guides, News, & Discussion] BGray210:
If you were able to decompile LG UP, wouldn't there be a way to write a program that displays the exact actions UP is doing with LAFD? Something along the lines of how Linux shows a rundown of the tasks being completed during boot, a program that could read what UP is communicating with LAFD. Just a thought and thanks for all of your hard work. I understand the majority of what you've written but am not familiar enough with IDA nor have a USB Sniffer ?