yashsingh1/xdaforums huggingface dataset:
[LG V20 Guides, News, & Discussion] runningnak3d:
I don't know for certain, but the only reason that LG would have to replace my CPU (that I can think of) is if the tamper fuse was blown. If you flash firmware with the wrong RSA key, all they need to do is use the firehose to put the firmware back on the phone -- that is not considered tampering by the TZ. I was playing with some completely undocumented opcodes trying to get the phone to boot from SD card. They are undocumented because there are no sniffs available since LG UP never sends those opcodes (well OUR version doesn't -- even when lab mode is unlocked). It is my guess that I just hadn't rebooted the phone until I flashed the wrong aboot, so my phone was bricked in two ways. Again, this is speculation -- but it fits with what was replaced, and what I was doing at the time.

-- Brian
[LG V20 Guides, News, & Discussion] emdroidle:
You shouldn't have had the word "mistake" anywhere in that paragraph. As you point out in the next two sentences, it is a decision that has upsides and downsides. LGE thought the upside outweighed the downside. Now that the DirtySanta engineering aboot leaked, they're stuck with that disadvantage.

Can you retrieve the RSA key from QFPROM? How big is the key? If it is small enough, it might be possible to crack... (key factoring algorithms have been getting better, processors have been getting more powerful; RSA is pretty well end-of-life due to these factors)

I'm pretty sure a number of people would very much like this information. Guessing it is simply need a SD card formatted with an appropriate GPT (grab the UUIDs from the device or KDZ?) and then copy the appropriate blobs from the phone or potentially KDZ?

Could be interesting to create an SD boot card which has the DirtySanta bootloader preinstalled on it.

There are two effective approaches available to get the slice sizes without root. First, KDZ files include copies of both GPTs. Simply retrieve those two blocks and you can get the sizes from there. Second, the Linux kernel dumps most of the slice information to the kernel message buffer on boot, simply need to get the really early logs and you've got most of the information. I prefer the latter since it also gives you the UUIDs.

Yup, the V20s are all completely unlockable. Only trick is adapting the methods to each device. Other issue is some phones don't have KDZ files.

Do you have a V20 console cable? There are indications /dev/ttyHSL0 is connected to the headphone^W"earjack" and one wonders whether the bootloader also logs to that device.
[LG V20 Guides, News, & Discussion] askermk2000:
[MENTION=3167089]runningnak3d[/MENTION]

[MENTION=6984210]emdroidle[/MENTION]

A while back I was in contact with [MENTION=7006025]BigCountry907[/MENTION] in PM.

He has done some work with SD-Card booting on Qualcomm before. He was willing to help out but suddenly he disappeared from the forum, I haven't heard from him since.

We did exchange a few messages, and there where some interesting info there. I will post a open word document here with the content.
[LG V20 Guides, News, & Discussion] runningnak3d:
The big problem with testing booting from SD card is that as long as there is a valid boot loader on UFS, the PBL will boot from that. There ARE test pins to force booting from SD card, but we need an msm8996 doc leak to find them ... trial and error, and I am not willing to risk my phones for that :)

If I end up with a phone in qdload mode, I will certainly use the knowledge I have gained. Heck, I may find one on eBay to use for testing.

I will post all the info I have gathered from my other research in the thread you started when I am back at my PC.
[LG V20 Guides, News, & Discussion] askermk2000:
Ok, good. I still have my h918 so I'll start experimenting again with the new insights at hand.
[LG V20 Guides, News, & Discussion] runningnak3d:
I was really busy at work today, so I didn't have time to do much. Tomorrow being Friday, I will have much more time.

-- Brian
[LG V20 Guides, News, & Discussion] dricacho:
Love your enthusiasm runningnak3d! Will be following this since I'm so bored with my Sprint V20, I never rooted it since day one when I first got the phone on Nov of 2016.
[LG V20 Guides, News, & Discussion] BROKEN1981:
Just wish we can have Paranoid Android for the lgv20. But I'll settle for stock rooted if it can even be done.

I don't see how it can be achieved with out an exploit but then again I'm not that smart either. Either way, thank you for trying.
[LG V20 Guides, News, & Discussion] jcpowell:
Watching this closely.
[LG V20 Guides, News, & Discussion] markmessier8888:
Me too!
[LG V20 Guides, News, & Discussion] runningnak3d:
I haven't really posted any updates because -- well -- there haven't been any to post. I do have some additional help now, so maybe with two of us looking at it we might have root before the end of the century :P

Actually a lot of progress has been made on decoding the opcodes, but not enough for any progress towards writing to an individual partition (sde2 -- I am looking at you).

This isn't a matter of if, but a matter of when. Once we can flash individual partitions, we will be able to flash sde2 (recovery). On the H918, that will then be enough to root. On all other models, we will be able to flash sde6 (aboot) with the engineering aboot, and sde2 (recovery) and again, that will give those models an unlocked bootloader, and TWRP.

As a side project, I am working on figuring out what needs to change so that we can unlock the bootloader without the need of the eng. aboot. I thought I had it with the H910, but there were some side effects that I have to work out the kinks on. It is not a priority since we DO have the engineering aboot, but other LG phones aren't as lucky...

-- Brian
[LG V20 Guides, News, & Discussion] nimaim:
[MENTION=3167089]runningnak3d[/MENTION] thanks for your enthusiasm and effort on this. I am keeping my V20 around as I'm confident you guys will figure it out. Can't wait til the day we can fully crack this beast.
[LG V20 Guides, News, & Discussion] markmessier8888:
When root is possible donyou think the Korean F800 models will also be able to be rooted?
[LG V20 Guides, News, & Discussion] dudeawsome:
any update on root
[LG V20 Guides, News, & Discussion] dudeawsome:
replaced my v20 tmobile charged 20 bucks
[LG V20 Guides, News, & Discussion] popwar:
Did you buy it outright or used
[LG V20 Guides, News, & Discussion] dudeawsome:
no I had preorder the v20 from tmobile on installment plan so have the day 1 v20 and I was having the ghosting issue and so called tmobile they told me they would replace for 20 bucks
[LG V20 Guides, News, & Discussion] bigshotrob22:
What's the ghosting issues? Is it refurb?
[LG V20 Guides, News, & Discussion] dudeawsome:
go through the lg v20 reddit an no it was brand new pre-ordered
[LG V20 Guides, News, & Discussion] blkwdoss:
I am really hoping for success here, I am very glad that you have enthusiasm and determination for this platform. I wish I knew more so that I could help, sadly I only know enough to break things. I am using the H910 on H91010p and after reading the many pages of the dirty santa thread over the last few months, I have felt very discouraged about the future of this device. This thread brings back some of that hope.
[LG V20 Guides, News, & Discussion] popwar:
I look here everyday but probably should wait a month and come back maybe there will be a solution
[LG V20 Guides, News, & Discussion] ph4nt0m117:
Speaking of, how goes it?
[LG V20 Guides, News, & Discussion] Septfox:
I kind of wonder if you (well, maybe not you personally, but unaffiliated developers in general) have a guardian angel in their service center.

After all, nothing screams "the user was where they weren't supposed to be, doing things they weren't supposed to be" like blowing a tamper fuse, or if not that, irreparably bricking the CPU in some other way. In my experience as a mild power-user, it's difficult bordering on impossible to kill a Snapdragon under normal use.

On the other hand, maybe it was so dead they couldn't actually figure out what the hell you did to it, and wrote it off as a defective unit. Who knows :v
[LG V20 Guides, News, & Discussion] Josh McGrath:
That last part is my theory as well. That and the techs aren't very bright, which is usually the case. They are usually underpaid and overworked and usually don't even know what a kernel is much less a tamper fuse
[LG V20 Guides, News, & Discussion] runningnak3d:
Since LG just settled the boot loop suit, and those of us who don't get the 425 / 700 offer at least get an extra 30 mos. of warranty -- it is my guess they have been told "fix them and don't cause Waves" :)

As for an update on the progress. I am having to learn ARM assembly .. so no ETA.

Can't just go randomly throwing numbers at these opcodes and see what sticks.

The opcodes that are used by LG UP were fairly easy to figure out because:

1 - the MacOS dylib file had debugging info

2 - I could sniff the USB traffic while LG UP was talking

lafd has been stripped of all debug symbols, and since these opcodes don't exist in LG UP, the only way to figure out what parameters they are expecting is to follow the code path.

-- Brian
[LG V20 Guides, News, & Discussion] ph4nt0m117:
Wow that sounds incredibly tedious. I'd love to watch you work.
[LG V20 Guides, News, & Discussion] runningnak3d:
So now we get to the part where someone with an H918 that is still on 10j or lower gets to step up and help.

We were (unknowingly) trying to mix and match opcodes for flashing KDZs with TOTs plus the unknown never before seen ones.

Flashing KDZs and TOTs are two completely different methods of flashing when it comes to lafd -- separate code paths.

So, I finally found an H918 10d TOT file and took a look at it -- it has no SIGN, as near as I can tell other than checking the header, the partitions, and the hashes of the partitions, there aren't any other checks that are done.

However, I need to see the sniff output from flashing a TOT to know exactly which opcodes are used, and the parameters that are set on them.

So -- who has an H918 that is still ARB 0 that is willing to help out here? If I have to, I will buy one off of eBay (and that I WILL take donations for). I will continue to try and figure out the couple of pieces that are stopping me from creating a TOT. A TOT is SOOOOO much more simple than a KDZ, and it is plainly obvious that there is nothing involving RSA signature checking, but there are a few bytes here and there that I can't make out what they are used for. Again -- a couple of bytes does NOT a signature make :)

-- Brian
[LG V20 Guides, News, & Discussion] steadfasterX:
Gosh yes.. We can even BUILD tot files (with a box) so it's obvious the creation and so flashing is completely different.

I will flash and sniff the tot process on my device soon! That could be the little tiny thing we need...
[LG V20 Guides, News, & Discussion] Josh McGrath:
[MENTION=3167089]runningnak3d[/MENTION] I have the kdz to my old v20 918 that I don't have anymore (I'm on the v30)

I will have to check which version it is, but I do know it was antirollback 0. I want to say 918d. Let me know if you need it
[LG V20 Guides, News, & Discussion] runningnak3d:
Thanks for the offer, but I have plenty of KDZs, but KDZs are what use RSA signature verification.

-- Brian
[LG V20 Guides, News, & Discussion] darkknight1812:
I have a 918 on arb 0 and willing to help out.
[LG V20 Guides, News, & Discussion] BROKEN1981:
count me in for that donation if needed!!
[LG V20 Guides, News, & Discussion] ph4nt0m117:
Hey if you need an LS997 I want to be first on the test.
[LG V20 Guides, News, & Discussion] Josh McGrath:
Oh man I didn't even think about that. My bad for not paying attention
[LG V20 Guides, News, & Discussion] ph4nt0m117:
Complete curious thing here.... Because of how all of this goes together (trying to learn the android structure here) would it be possible to flash Kernel 4.15 or kernel 5 when it drops?
[LG V20 Guides, News, & Discussion] askermk2000:
Theoretically possible if you did a lot of coding, rewriting drivers etc... in reality nobody's going to do that.

LG G5/V20 uses the Linux 3.18 kernel, that's how it is. Though I did read something about maybe we'll see 4.4 kernel at some point, think it was emdroidle who mentioned it.
[LG V20 Guides, News, & Discussion] flips13:
So on what stage you work is currently and what you need now from us?
[LG V20 Guides, News, & Discussion] storm68:
I honestly don't think much is needed. Since this has been in the works since September of last year. This ARB01 from the looks of it is a royal arse and people have moved on to other phones. I myself already updated to 10s and will be moving along as well in a month or so. The V20 community sadly has gotten extremely small in comparison to early last year. It's the name of the game I guess, but, I do thank these guys for trying. Cool beans. :svetius::svetius::svetius:
[LG V20 Guides, News, & Discussion] ph4nt0m117:
Hey mang, I have frozen updates on my phone until this is done. I am not living with this phone for 3 or 4 years with its current ROM and battery life, nor ami I selling it to get a different phone.
[LG V20 Guides, News, & Discussion] storm68:
That's cool. :svetius:
[LG V20 Guides, News, & Discussion] flips13:
Sad to hear this :( as this is pretty good device. It's just not enough root rights and custom recovery:p
[LG V20 Guides, News, & Discussion] storm68:
Pretty cool article that came out in XDA news about exploit. Tried to put link here but wouldn't let me. Just came out. :svetius:
[LG V20 Guides, News, & Discussion] steadfasterX:
https://www.xda-developers.com/exploit-qualcomm-edl-xiaomi-oneplus-nokia/

source: https://alephsecurity.com/2018/01/22/qualcomm-edl-1/

.
[LG V20 Guides, News, & Discussion] Josh McGrath:
I looked into this a while back, I didn't try very hard on it cause it's confusing as hell and everything I tried came up with an error and no one wanted to explore it further I guess [emoji16]

If you do a search in the progress to root, you'll see my post a few pages back. Any help would be appreciated
[LG V20 Guides, News, & Discussion] storm68:
Did this get put on hold for awhile or just not having any luck?
[LG V20 Guides, News, & Discussion] xdamember143:
Be patient I'm pretty sure he has more important things to do first .
[LG V20 Guides, News, & Discussion] storm68:
It was just a simple question. I've been here long enough. (XDA) Why do I even bother. Never mind....
[LG V20 Guides, News, & Discussion] xdamember143:
And I answered your simple question in a calmly matter . ?What did I offend you in some way ? Oh god Its these comments that make the developers get angry and stop the development all together which is bad since not every body is rude and ungrateful. Just look at iOS the main developers or coders that work for getting jailbreak available on each firmware update sacrifice their time and day to help the community that want jailbreak and they do all this for free? . Key word FREE ,but with people complaining and nagging all the time , they get discouraged easily and stop the development all together which sucks since it helps a lot dude .All I'm saying is that I have nothing against you man and perfer not to get the process of getting root for our phone halted .
[LG V20 Guides, News, & Discussion] runningnak3d:
From the link:

"To make any use of this mode, users must get hold of OEM-signed programmers, which seem to be publicly available for various such devices. "

There hasn't been a signed programmer leak for an LG device since the G4 that I am aware of (trust me I have looked).

If we could find one, we wouldn't even need to exploit it since we have an engineering aboot.

No, this has not been put on hold. I haven't posted any updates because there was nothing to post. TOT flashing has been removed from lafd. The code is still there, and LG UP will even try to flash one, but the result is the same as trying to flash an individual partition -- ERSE works, but with no SIGN .. no flash. So what you end up with is an erased partition.

So, it is back to trying to figure out indirect flashing mode, but without sniffs, that is a lot of guess work. No results yet other than data being written where it shouldn't, and that would brick a phone.

Not going to give up on this unless I can prove conclusively that it is impossible.

-- Brian
[LG V20 Guides, News, & Discussion] storm68:
Thank you for the update in reference to my question and the link thereof. I appreciate your ways of being professional. :good:
[LG V20 Guides, News, & Discussion] runningnak3d:
So I got a package in my email today -- a signed firehose. It is for the H915, but remember, ALL LG V20s use the same RSA key except the H918. Sorry guys, you will still be out of luck if this is legit.

Here is the problem. In order for me to test if it is legit, I will have to intentionally brick my phone since there is no way to boot to EDL (9008 QD_loader). I was scratching my head on how do you brick a phone that hasn't been rooted, and I was reading one of [MENTION=5545101]steadfasterX[/MENTION]'s threads, and he had the idea -- wipe the TZ partition.

So, once I get some liquid courage in me to try it. I am going to brick my phone, and see if this is a legit firehose. If it is, then all V20s except the H918 will have root again -- no matter their ARB version.

One of three things is going to happen:

1 - It is legit, and I can flash partitions and have a normal phone

2 - It is bogus, and either isn't signed, or is signed with a different RSA key (I will be checking those -- but even if the sig matches, it could still be a bogus file). I am left with yet another brick

3 - It is an engineering or debug firehose and it blows the debug qfuse. This can either be a very good thing (can run unsigned code!), a very bad thing (can't run anything), or an 'ehhh' -- phone doesn't work quite right.

If it is anything other than #2 -- left with a brick, I will start a new thread to discuss programming with a firehose.

Oh, yea, I almost forgot -- the phone I got back from LG is ARB 2 AND the LAF partition is no longer a standard android boot image -- it is something else entirely, but I can't tell because I can't dump it. All V20 lafds have been version 1.0.0.4, this is 1.0.0.8. The highest version that I or the guys I have been working with have seen is 1.0.0.6. What is strange is that it is still H91810s which should be ARB 1 and 10s LAF is just an Android boot image and still has all the opcodes (version 1.0.0.4). So they flashed my phone with something new without incrementing the version. I have NO IDEA if this is standard policy, or if they gave me a special "you can't root this" phone.

-- Brian
[LG V20 Guides, News, & Discussion] askermk2000:
Interesting.

What about that firehose I found a while back, have you looked at it? I wonder if it's the same as the one you got now.
[LG V20 Guides, News, & Discussion] runningnak3d:
I will have to dig that up and do a hexdiff.

I completely forgot about that - lol. I wasn't willing to touch that one because I didn't know what I was doing back then.

Thanks for the reminder dude.

-- Brian
[LG V20 Guides, News, & Discussion] Josh McGrath:
Maybe a stupid question here, but dont the v20 and v30 share partition tables?
[LG V20 Guides, News, & Discussion] runningnak3d:
No. Even different models of the V20 and V30 have different partition tables. But I have to ask -- why? Let's say they did, there is nothing you could use.

A firehose, or a kernel exploit is the only thing that is going to get us root. Even an exploit of a system app could be found, it would have to be a system app with the right SELinux contexts -- namely the ability to write to block devices.

RSA signing + dm-verity + SELinux has made this almost impossible.

If the firehose that I have doesn't work, I will probably throw in the towel. If it does work, I will see if I can get one for the H918 V20 and H932 V30. Unless an engineering abl (what used to be aboot) leaks for the v30, no other model will ever have root.

-- Brian
[LG V20 Guides, News, & Discussion] runningnak3d:
Well what do you know. This firehose is signed, and it is signed with the same cert as aboot:

aboot

EA FA 50 5C A3 DF 1D E3 15 1A DB FE A3 0E 57 21 FA 45 E3 00 88 DB 08 53 F0 DE 80 34 7E F0 82

firehose

EA FA 50 5C A3 DF 1D E3 15 1A DB FE A3 0E 57 21 FA 45 E3 00 88 DB 08 53 F0 DE 80 34 7E F0 82

Woot -- it isn't stripped either. All the debug symbols are here, so I can go through this and find out if it is going to blow any qfuses.

Another update coming soon....

-- Brian
[LG V20 Guides, News, & Discussion] ph4nt0m117:
I'm pumped. I hope this finally makes the root possible.
[LG V20 Guides, News, & Discussion] runningnak3d:
I am going to go through this with a fine tooth comb before I risk my device, but after decompiling it, and giving it a quick cursory glance, it doesn't look like ANY calls are made to the fusing functions on init.

If anyone was curious (I was) as to whether you could use a firehose to just write anything you wanted -- nope. It checks the signature of the image being written, and if it doesn't pass -- no flash. Well, again, our engineering aboot is signed, or our phone wouldn't boot :)

So it looks like the full root procedure will be:

* Have a FULLY charged phone

* Dump TZ (just to make sure that you have a copy on hand) - tool will be provided

* Wipe TZ to get into EDL mode (yes - this is the scary 9008 - doesn't look like the phone even powers on mode) - tool will be provided

* Use QFIL to flash TZ that you dumped, and engineering ABOOT

* You will now have full fastboot so you can fastboot flash recovery twrp.img :)

* Profit!

This will work on any model V20 except the H918. You guys can thank T-Mobile for deciding to use their own cert.

I will try to contact the person that provided me this firehose and see if they are willing to provide one for the H918.

Lastly, I will be testing this later tonight once I chew through this decompiled code a bit more...

-- Brian
[LG V20 Guides, News, & Discussion] BROKEN1981:
I'm happy other V20 users would have root. The process seems very complicated.

Also, since it will put back fastboot commands, what would happen if you unroot and take an OTA? Would it erase the full fastboot commands? I would assume so.
[LG V20 Guides, News, & Discussion] nymikey:
Even a spec of hope for us H918 users is enough for me.... ?
[LG V20 Guides, News, & Discussion] Zacharee1:
LG's software team is inept enough that I'm sure we could find the H918 eng aboot online if we tried hard enough :p
[LG V20 Guides, News, & Discussion] runningnak3d:
The H918 can unlock their bootloader so they don't need an engineering aboot.

They could just flash TWRP straight from the firehose if one can be found.

-- Brian
[LG V20 Guides, News, & Discussion] lightninbug:
Will this work for TMobile v30 users?!?
[LG V20 Guides, News, & Discussion] dudeawsome:
wow man! I know h918 hasn't got a root method yet but after this, I believe h918 will get root. Thanks!
[LG V20 Guides, News, & Discussion] TheDannemand:
I've being reading up and following your work for awhile now, and your persistence with this project is commendable.

I am very glad your efforts finally paid off, both for you and the community!

As a systems and assembly language programmer from a different era, having done a lot of disassembly and reverse engineering myself, I totally appreciate and admire what you have accomplished here. Well done!
[LG V20 Guides, News, & Discussion] steadfasterX:
These two steps can be done in SALT :)