yashsingh1/xdaforums huggingface dataset:
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=7075689]TheLogicalGamer[/MENTION] This first version will only work on UFS devices that have an unlocked bootloader (H830 G5, H918 V20, and H872 G6).

I have not figured out how to copy across block devices reliably yet. So for this first implementation, it will require overwriting laf with TWRP since the laf and misc partitions are both on sda. aboot and recovery are on sde. For all V20s besides the H918, it will require flashing the engineering aboot BEFORE flashing TWRP, and that means I have to solve cross block device copying.

Once booted into TWRP (you will boot to it just like you do download mode), you can flash TWRP onto recovery (where it belongs :) ), and then boot into recovery to flash laf back onto the laf partition, and flash Magisk (or the root of your choice) reboot and enjoy root.

This is still very much a learning process, but I wanted to get what is working out there for the folks that can use it.

[MENTION=5070414]Josh McGrath[/MENTION] Without the COPY opcode and no way to flash a laf version that has it, this will not work on the V30. Once I solve the cross block device copying so that all V20s can enjoy root, I will go back and start looking at the V30 lafd again to see if some other hole can be found.

-- Brian
[LG V20 Guides, News, & Discussion] Josh McGrath:
Looks like v30 is ufs 2.1. if that helps at all for anybody
[LG V20 Guides, News, & Discussion] TheLogicalGamer:
So for the h918 I just need to flash twrp to the laf/download partition. Boot in dl mode flash twrp to recovery. The only questions I have atm are.

1. Where would I get the laf image to flash via twrp.

2. Would standard store lg up & the h918 dll work for this process.

3. This will work on 10p? And can't be patched unless I update the stock firmware further?
[LG V20 Guides, News, & Discussion] draymond1987:
Damn bro, that certainly sucks that your lenses kept breaking /:

I mean, I am confident that I won't be charged, since I have bricked the G4 twice. Only positive to that was, it would not turn on at all, even with a charger. Fun times. I should just lock and unlock the BL a few times, to make it look like somebody turned messing with it via my computer (remote access). Kidding, of course.

I am just going to view the progress on here regardless of what phone I may have. If our V30's gain root then I can use another JUMP. Gotta love that JOD !
[LG V20 Guides, News, & Discussion] runningnak3d:
1 - You will dump laf as part of the process, but you could extract it from a KDZ if you forget.

2 - No, you will need to install Python and some modules (it will be in the final write-up). This talks directly to lafd.

3 - Yes, this will work on 10p, but anyone that has upgraded to a later version that doesn't have the COPY opcode can flash the 10p laf.

-- Brian
[LG V20 Guides, News, & Discussion] jimenezboy:
I believe [MENTION=3167089]runningnak3d[/MENTION] is finalizing the process and tying up any loose ends, after which he will write a comprehensive post with all the details about how to go about it, like his detailed post on how to root the AT&T V20. Can't wait to wake up to that new post :D :D
[LG V20 Guides, News, & Discussion] Josh McGrath:
Ignore
[LG V20 Guides, News, & Discussion] BROKEN1981:
Hahaha brother, you are going to get that dev tag. I truly can't wait to see that after all your hard work.
[LG V20 Guides, News, & Discussion] Josh McGrath:
I'll probably run the tool on my v30 to see what happens ? probably nothing if the opcode isn't there but oh well lol

Good job after your months of work. I'd also check out the G6 bounty thread for yourself
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=5631635]BROKEN1981[/MENTION] It is done (well for the H918) just tested it from start to finish and I have TWRP sitting on my screen after I held vol up and plugged in my USB cable :)

If you are ready to try it, here is the "quick" guide:

* Install Python 3.x (make sure to put it in your path)

* Open a command prompt and type (if you are on Linux, use pip3:

* pip install cryptography

* pip install PyUSB

* Install git

* Open a git bash shell and type:

* git clone https://github.com/runningnak3d/lglaf

* git checkout h918-miscwrte

* cd lglaf

* ./partitions.py --dump laf.img laf

* ./partitions.py --dump misc.img misc

* ./partitions.py --restoremisc twrp.img laf

Of course you need the H918 TWRP image in that directory, and replace the name with whatever it is called.

When it is done flashing, pull your battery, and go back into download mode (vol + and plug in USB)

You will be sitting at TWRP.

* Flash TWRP onto recovery

* Flash laf.img and misc.img back onto the laf and misc partitions. Since TWRP doesn't have that ability, you will have to do it at the command line

* adb push laf.img /dev/block/bootdevice/by-name/laf

* adb push misc.img /dev/block/bootdevice/by-name/misc

* Flash Magisk and reboot!

Enjoy your now rooted H918...

If this scares anyone, I will make it easier, but for the hardcore people, I wanted to get it out there.

-- Brian
[LG V20 Guides, News, & Discussion] BROKEN1981:
This is why you need to be patient and not jump the gun. If the OP did not sign off on it, better to leave it alone. If you don't remain clam, I can see you bricking more devices in the future.

I know there is a lot to read in this topic, but if you did read it all, you would not have ended up with a brick.

Just friendly advice.
[LG V20 Guides, News, & Discussion] runningnak3d:
FYI - I am keeping TWRP on laf as well. I would rather have two copies of TWRP than TWRP and laf. Think about, which is easier to fix your phone with. If you brick it so bad that you have to use download mode, then TWRP is just as good, and if TWRP won't load from laf, then neither would actual lafd.

-- Brian
[LG V20 Guides, News, & Discussion] Zacharee1:
That seems pretty easy actually (definitely more straightforward than the Verizon Note 4), but what's the brick risk? I kind of want to flash TWRP to laf on my phone, even though I'm already rooted, because you're right that it's more robust.
[LG V20 Guides, News, & Discussion] omariscal1019:
Ice work dude... One question theres no twrp cor the tmo g6 yet. Wat can we do?
[LG V20 Guides, News, & Discussion] runningnak3d:
There is zero risk of a brick just flashing TWRP onto laf (well no more than flashing anything else :) )

Hmmm, that is a real pickle because you kinda need to test it, and it will be an all or nothing test.

When I finish getting the other V20s rooted, I can take a look at the US997 TWRP. It may just be a matter of tweaking build.prop, and packaging it up with a kernel that works on the H872.

Heck for that matter, it may just work. It is not like the old days where there were major differences between models.

-- Brian
[LG V20 Guides, News, & Discussion] runningnak3d:
Well holy crap. I made a mistake when I was testing (don't worry -- it is fixed), BUT because of that mistake I now know how to copy from block device to block device -- all because of a typo.

It is going to take more work (so it won't be tonight), but root for all the other V20s is coming ASAP.

Maybe I can finally start working on some fun stuff :P

-- Brian
[LG V20 Guides, News, & Discussion] Zacharee1:
Alright, that's good to hear. Is there a way to use ADB to reboot to LAF, or is it only the VOL-UP method?

BTW, you also need PyUSB. And if you're on Ubuntu or a similar Linux distro, you'll need to use pip3 install ..., since Python 2.7 is the default.
[LG V20 Guides, News, & Discussion] Zacharee1:
Most amazing discoveries are made by mistake. This one is no different :p
[LG V20 Guides, News, & Discussion] runningnak3d:
The only way that I know of is the normal vol + / USB plug. There is supposed to be a key combination to boot to it, but I haven't found it yet.

Thanks for the reminder about PyUSB. I am on Linux, and it has been a LONG time since I setup this dev environment.

-- Brian
[LG V20 Guides, News, & Discussion] Zacharee1:
I was about to say "well I just read the error messages," but then I realized how uncommon that is nowadays...
[LG V20 Guides, News, & Discussion] omariscal1019:
Thanks will be patiently waiting!!
[LG V20 Guides, News, & Discussion] runningnak3d:
New lafsploit thread started.

This thread really needs to be cleaned up so that it is easier to find the pertinent information. If one of the mods feels like going through all these pages and deleting any post that doesn't provide actual technical details, it would be appreciated. If not, I can go through and pull out all the important posts and make a new thread.

-- Brian
[LG V20 Guides, News, & Discussion] The_Anomalist:
Whoa

This is awesome. I have a tmonile lg g6 so I am so dang excited. Is there a way to do this on windows?
[LG V20 Guides, News, & Discussion] Zacharee1:
The instructions are actually for Windows. If you're on 10 or later, open the Windows Store and search for Ubuntu. Install that, and then install the dependencies like so:

pip3 install cryptography
pip3 install PyUSB

Follow the rest of the guide normally.

If you're not on Windows 10, you'll need Git BASH, and Python 3 before just following the rest of the instructions.
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=7055541]Zacharee1[/MENTION] I don't have Windows to test on, so I really appreciate the tips. I forgot that Windows 10 now has Ubuntu. That will make things a LOT easier.

-- Brian
[LG V20 Guides, News, & Discussion] The_Anomalist:
This is awesome I didnt realise windows 10 had that feature lmao I'm trying tonight

---------- Post added at 11:28 PM ---------- Previous post was at 11:24 PM ----------

Since there is no temp for the h872 what do u propose I do? Use the h870 twrp or what? Or the usb997
[LG V20 Guides, News, & Discussion] Zacharee1:
Personally, I think you should wait a bit. We've got root for the H918, and the rest of the V20 variants are soon to follow. Once that's done, [MENTION=3167089]runningnak3d[/MENTION] says he'll be able to build a TWRP for the G6.

I guess you could try the US997 TWRP build. It might not work, but if you don't get the LAF screen, you'll know something happened.
[LG V20 Guides, News, & Discussion] SJMarty:
First of all, thank you for all of your efforts and we are all glad it has paid off!

Rather than cluttering the new thread, I have a couple of questions on the steps. Apologies in advance but I have not worked with Git before so the answers are probably obvious to some...

The clone command works. When I enter the checkout command, I get...

fatal: Not a git repository (or any of the parent directories): .git

Do I need to change to lglaf before entering the checkout command? Doing that seems to work but I want to make sure before proceeding.

Also, where should I get the TWRP image from?

Thanks.
[LG V20 Guides, News, & Discussion] runningnak3d:
Actually it is more than that. I need a partition listing to make sure misc is in the same location on the G6. If not, you will brick your phone.

Run partition.py --list

And paste it someplace.

-- Brian
[LG V20 Guides, News, & Discussion] runningnak3d:
Yes, you need to cd to lglaf before the checkout. Sorry about that. I will fix the instructions.

-- Brian
[LG V20 Guides, News, & Discussion] The_Anomalist:
I have to run that command while in laf mode correct?
[LG V20 Guides, News, & Discussion] runningnak3d:
Correct.
[LG V20 Guides, News, & Discussion] The_Anomalist:
Okay. I'm not home right now so will try later but also is there laf mode for the g6?
[LG V20 Guides, News, & Discussion] runningnak3d:
Laf mode is download mode. With the phone off, hold vol + and plug in the USB cable.
[LG V20 Guides, News, & Discussion] The_Anomalist:
im having issues with it.

Linux-Beast@Catdaddy616:~$ pip3 install cryptography

The program 'pip3' is currently not installed. You can install it by typing:

sudo apt install python3-pip

Linux-Beast@Catdaddy616:~$ sudo apt install python3-pip

Reading package lists... Done

Building dependency tree

Reading state information... Done

E: Unable to locate package python3-pip

Linux-Beast@Catdaddy616:~$ pip3 install cryptography

The program 'pip3' is currently not installed. You can install it by typing:

sudo apt install python3-pip

Linux-Beast@Catdaddy616:~$
[LG V20 Guides, News, & Discussion] runningnak3d:
sudo apt update

That will update your package list
[LG V20 Guides, News, & Discussion] Zacharee1:
Run 'sudo apt update' first. Then install it again.
[LG V20 Guides, News, & Discussion] SuperPerfection:
??

I could be mistaken but this exploit is for the laf partition (aka download mode partition) not misc or am i missing something?
[LG V20 Guides, News, & Discussion] Josh McGrath:
I think that twrp has to sit waiting in misc before being sent to laf
[LG V20 Guides, News, & Discussion] TheDannemand:
(That post of mine was actually meant for a different thread, and I have requested it be deleted from this thread).

I was referring to the post here in which [MENTION=3167089]runningnak3d[/MENTION] describes that he needs to verify location of misc on G6.

As I understand, misc is used as a go-between for flashing TWRP onto laf -- from where it can be booted and then used to flash TWRP onto recovery.

Edit: [MENTION=5070414]Josh McGrath[/MENTION] beat me to it.
[LG V20 Guides, News, & Discussion] nickland:
Nevermind. Let me instead say thanks to everyone who made this possible especially OP. You are the man.
[LG V20 Guides, News, & Discussion] tswb:
hey i just wondering if someone can do an video how to do it. it help a lot.
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=1389880]nickland[/MENTION] Use the new instructions in the dedicated lafsploit thread.

-- Brian
[LG V20 Guides, News, & Discussion] J Bee:
Congratulations master [MENTION=3167089]runningnak3d[/MENTION] for your hard work

Any instructions for v10 user's?
[LG V20 Guides, News, & Discussion] The_Anomalist:
LAF Crypto failed to import!

Traceback (most recent call last):

File "./partitions.py", line 459, in <module>

main()

File "./partitions.py", line 406, in main

comm = lglaf.autodetect_device()

File "/home/Linux-Beast/lglaf/lglaf.py", line 441, in autodetect_device

return USBCommunication()

File "/home/Linux-Beast/lglaf/lglaf.py", line 299, in __init__

raise RuntimeError("USB device not found")

RuntimeError: USB device not found

root@Catdaddy616:/home/Linux-Beast/lglaf#
[LG V20 Guides, News, & Discussion] Josh McGrath:
Do you have the LG drivers installed?

Also use a 2.0 slot if possible. Is 3.0 can cause issues for some
[LG V20 Guides, News, & Discussion] The_Anomalist:
tried both i got drivers and am using usb 2.0 still getting no device error
[LG V20 Guides, News, & Discussion] Guest007:
Can you write a manual for rooting T-Mobile (H901) V10 with latest firmware?

Thank you
[LG V20 Guides, News, & Discussion] askermk2000:
Hey

I have compiled kernel for H872. I didn't see any related thread in G6 section so I though I'd post it here.

https://www.androidfilehost.com/?fid=746010030569969033

I suppose one could put my/stock h872 kernel inside a us997/h870 TWRP image as well, if even necessary. I could do that easily, but I guess

it's best if someone with a proper lineage/omni repository at hand would build from scratch.
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=5744036]J Bee[/MENTION] I will post the instructions for the V10 in the V10 forum once the issue with Windows dependencies is ironed out. Not having a Windows box to test with makes it so I have to rely on others to get the instructions correct for Windows users.

-- Brian
[LG V20 Guides, News, & Discussion] BROKEN1981:
I don't need to go to work today so I will make some tea and do this in 5 minutes.
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=5631635]BROKEN1981[/MENTION] You might want to use the more detailed instructions that [MENTION=7055541]Zacharee1[/MENTION] typed up in the lafsploit thread. Again, can't thank him enough for putting those together. I suck at documentation :)

-- Brian
[LG V20 Guides, News, & Discussion] BROKEN1981:
Is there a direct download for Ubuntu? I used powershell to delete W10 app store and have no clue how to get it back lol.

Going to use my Google skills now.
[LG V20 Guides, News, & Discussion] runningnak3d:
If you search for wsl server 2019 there is a link to the appx that you can install without the store since 2019 doesn't have a store.

It is sad that I know as much as I do about Windows since I haven't used it in years - lol.

-- Brian
[LG V20 Guides, News, & Discussion] ph4nt0m117:
Only days away from freedom of ****ty sprint packages, google play services fore draining my battery, and that sweet sweet smell of private encryption..... Mmmm~

[MENTION=3167089]runningnak3d[/MENTION] I have full disk encryption turned on because I was travelling. I assume I need to reset my phone before doing anything like this? Hopefully the LS997 won't be a giant pain in the ass :P
[LG V20 Guides, News, & Discussion] tswb:
hey do i install the H91810j on v20 before i install twrp and i use Windows 10 what i use to install the kaz. i got h91810s i need help im new to lg phone. thanks
[LG V20 Guides, News, & Discussion] J Bee:
Perfect:good:
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=5011229]tswb[/MENTION] follow the instructions here. I believe I have all the links you will need in there.

-- Brian
[LG V20 Guides, News, & Discussion] BROKEN1981:
any way to use this without Ubuntu? I have no clue what i am doing. i tried to run it on a VM because thats the only way i could figure out how to run it.
[LG V20 Guides, News, & Discussion] runningnak3d:
Yes, there are instructions for installing Python and git on Windows natively.

-- Brian
[LG V20 Guides, News, & Discussion] tswb:
so need to be on the 10p firmware to flash laf partition kdz. it above or below 10p and how to select laf. can u do a video or explain slowly im on 10s firmware im rookie. the link u gave me is unlocked bootloader. i dont understand. if i install the kdz h91810j will the phone boot or dont install it. i have 10s
[LG V20 Guides, News, & Discussion] Denversmartphone:
Guys i have h871 but im italian...there is a chance to install italian firmware over this smartphone that is h871? because my italian motherboard burned..so i buy one from ebay used and it's work fine..but is at&t so no update without simcard at&t..i want this smartphone become italian with h870..i try lg up but it's say this no possible h871>h870.... so just tell me how i can do...
[LG V20 Guides, News, & Discussion] tswb:
how to flash kdz laf partition on lg
[LG V20 Guides, News, & Discussion] runningnak3d:
Use patched LG UP, and choose partition DL.

-- Brian
[LG V20 Guides, News, & Discussion] tswb:
does anyone has the lgup&v20dll patched i cant open it i got an error
[LG V20 Guides, News, & Discussion] jcpowell:
This has been one of the best and most rewarding threads to follow. Thank you [MENTION=3167089]runningnak3d[/MENTION] this is badass!!

Patiently waiting (actually chomping at the bit,lol) my turn with my LS997
[LG V20 Guides, News, & Discussion] runningnak3d:
H918 got root first, but they also get to help work the bugs out......

I wish I could have released something that was perfect, but that is just never the case.

-- Brian
[LG V20 Guides, News, & Discussion] Nickvanexel:
Any chance of getting something going for the vs988 Verizon g6?
[LG V20 Guides, News, & Discussion] Josh McGrath:
Hey, nothing is ever perfect. People will always have some trouble even doing the old now lg-free fastboot flash. I enjoy learning every step of the way and everyone appreciates your many hours of work!
[LG V20 Guides, News, & Discussion] runningnak3d:
Without being able to unlock your bootloader, no.

That is my next project though. I have not decompiled the G6 aboot, but on the V20, stock aboot still checks to see if it is unlocked, but there is no fastboot command to write to the partition the unlock bytes, so it is not possible to unlock it.

Now that we can write, it is just a matter of figuring out what to write and where. That will also allow unlocking without wiping the device.

Anyway, if the G6 aboot still checks, then the process will work for you guys as well.

-- Brian
[LG V20 Guides, News, & Discussion] SMTB1963:
Make sure the patched LG UP is installed in

C:\Program Files (x86)\LG Electronics\LGUP

or you will get an error.

When asking for help, post the error so people can better understand your issue.

Cheers!
[LG V20 Guides, News, & Discussion] wren2k:
Ok so I'll admit I may have missed it but I've been following the thread and I don't see anything referencing other variations of the v20 with this exploit. Is there a version which will work with the Sprint LS997?
[LG V20 Guides, News, & Discussion] TheDannemand:
You need to be unlock your bootloader first, which I believe is impossible on LS997 -- and all Sprint phones.

OP has indicated he'll look at other models later. But he's got a lot on his plate right now with this.
[LG V20 Guides, News, & Discussion] runningnak3d:
All V20 models except the H918 have to use the engineering aboot. Flashing aboot was risky enough using DirtySanta. I want to get all the kinks worked out as far as hash checking on the H918 before messing with aboot.

If the H918 loses laf, they only lose download mode until an OTA comes along that flashes it back, or you force it with an update.zip. If you lose aboot, your phone is toast -- there is no coming back from that. So, I am not about to post something that isn't nearly bullet proof -- but yes, it is coming.

-- Brian
[LG V20 Guides, News, & Discussion] cnjax:
Just stopping by to give props to running on the exploit. Glad I have a 910. Reading the root thread at the moment is scary. Guys thought the Dirty Santa root was tough lol ?
[LG V20 Guides, News, & Discussion] wren2k:
Ok, Thanks Brian. I'm glad for you and for the community that all your hard work paid off.
[LG V20 Guides, News, & Discussion] Josh McGrath:
[MENTION=3167089]runningnak3d[/MENTION]

I thought the G6 and v30 abl (aboot) was encrypted? I never pulled it to check with hex editor cause that's what I heard
[LG V20 Guides, News, & Discussion] Nickvanexel:
Ok cool. Only reason I'm in this thread because I started here with a ls997 v20, but since I couldn't get it unlocked I ended up getting this verizon lg g6. So I was watching this thread closely already and I remember early on there was talk of this being possible for all lg variants including the v10, g6 and v30.
[LG V20 Guides, News, & Discussion] runningnak3d:
The V30 abl is encrypted. The G6 still uses good old aboot.

-- Brian
[LG V20 Guides, News, & Discussion] BAFLGV20:
I've bin with this thread since day 1. I have the H918 so I'll be root"N" here shortly. Just had to say THANK YOU! Brian. for your time and wish the best for the rest of the v20,G6,v30,ect. users.
[LG V20 Guides, News, & Discussion] Moriatier:
what you are suggesting is that now for the V30 users, unless the bootloader can be unlocked, it seems to be impossible to root V30 models except for the open market variants and H932. Am I right?
[LG V20 Guides, News, & Discussion] ybnrmalatall:
V20 update?
[LG V20 Guides, News, & Discussion] Tilde88:
[MENTION=3167089]runningnak3d[/MENTION] is python 3.65 ok? I'm not getting a timeout, but I am getting something not referenced, then is_kernel_driver_active. Tired on Windows box and Ubuntu. Please let me know ty for everything kind sir
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=1325580]Tilde88[/MENTION] If you are going by that "quick guide" I posted in this thread, you also need to pip install cryptodome

You really should wait for the updated code. I know you want root right now (I sure would), but there isn't enough hash checks in that procedure. If you have a noisy USB bus, you could lose download mode.

If you are STILL going to do it, then at least flash the full 10p so that if you do lose download mode, you can take the OTA and get it back.

-- Brian