yashsingh1/xdaforums huggingface dataset:
[LG V20 Guides, News, & Discussion] runningnak3d:
Just an update. I am just super busy at work, so I haven't had a chance to type up the test post yet. If you have seen my post on rooting the H910 by flashing the H915 KDZ -- it will be something along those lines.

Also, I want to duplicate my work. I grabbed my G4, but while the Nougat lafd has the opcodes for indirect flashing, they don't appear to do anything. I am guessing that is another case of differences between eMMC and UFS devices. Either that, or it wasn't fully implemented yet.

So, I am backing up my H910, so I can flash it back to stock. Even though it is rootable via other means, this will still be a valid test.

EDIT: as a side note, the G4 guys have it easy. lafd has no restrictions on commands that can be run with EXEC. If you have a G4 with an unlocked bootloader, you can just put TWRP on the SD card and EXEC dd if=/storage/external_SD/twrp-blah.2.3.4.img of=/dev/block/mmcblk0 skip=<insert offset here>

So all you have to do is find the offset for the recovery partition (no brainer), and viola, you have TWRP. From there you can flash magisk....

-- Brian
[LG V20 Guides, News, & Discussion] Josh McGrath:
Just take your time. There's no rush on anything. I mean, we can all back up our candy crush in the meantime ?

Let me know if I can help with anything
[LG V20 Guides, News, & Discussion] J Bee:
Good news! What about V10 users?
[LG V20 Guides, News, & Discussion] runningnak3d:
The V10 uses eMMC storage just like the G4. Heck, you may be able to right now with the work that has already been done in [MENTION=5545101]steadfasterX[/MENTION]'s repo. Clone it and try: https://github.com/steadfasterX/lglaf.git

If nothing else, you can flash the G4 lafd. It definitely will work.

I am betting that you were looking for a "this just works" answer :)

Once I get the UFS models taken care of, I will tackle the V10 if any changes need to be made to the G4 code.

TL;DR: Yes, the T-Mobile (H901) V10 can be rooted even on the latest firmware.

-- Brian
[LG V20 Guides, News, & Discussion] runningnak3d:
Well this is effing frustrating. I have a phone here that has TWRP on it and I have no idea what I did to get it to flash.

When I tried to recreate my steps on the H910, it didn't do anything either -- so it wasn't just the G4.

If you use RSVD IDDD /path/to/flash the message about flashing / flashing complete shows up but there is no flash.

The only thing that I can guess is that I had sent TWRP via a MISC WRTE, and it was still sitting out in the temp buffer waiting to be flushed (I tried this again). One of the IOCT or COPY commands must have executed and flushed the buffer and I missed it in dmesg.

I have tried to retrace my steps, but I keep getting a write fail. So, it has to be one of the arguments that gets passed to IOCT or COPY.

I had a 10k line scroll back buffer, but that wasn't enough (dmesg dumps are HUGE). I am going to keep fighting with this. It is obviously possible.

This is going to drive me nuts.

I probably won't make another post until I can consistently flash TWRP because I know this must be just a frustrating for everyone that wants root.

-- Brian
[LG V20 Guides, News, & Discussion] Josh McGrath:
I don't think anyone will get frustrated. I think it's the other way around, most people would try to help.

I still have my replacement phone waiting on me if you want to try something that could potentially brick.

We are all rooting for you! No pun intended

Edit: I actually find your info posts fun to read
[LG V20 Guides, News, & Discussion] SJMarty:
Is there possibly a difference between the H910 and H918 that would make this command perform differently? Are you able to replicate the TWRP flash on your H918?
[LG V20 Guides, News, & Discussion] runningnak3d:
I flashed the H918 laf partition onto the H910 just to see. I also tried flashing stock recovery back onto the H918.

Here are the possible arguments that are unknown:

IOCT fd_num,unk1

COPY fd_num,unk2,offset,size

Unk1 is probably a bitmask

Unk2 is divisible by 512 on the sniff that was posted so it is my guess that it has to do with blocks in some way. On an eMMC device the block size is 512 .. on UFS it is 4096 so I took that into account.

Unfortunately the guy that posted the sniff didn't say what he flashed, and unlike an LG UP sniff there isn't any good indication.

Yesterday I wrote a script that sent possible values for both opcodes and then dumped dmesg grepping for [LAF]. I am guessing this command doesn't give the usual [LAF] prefix in the output so I missed it.

I am going to try again. It is a hail Mary, but if I save the logs from each run and them read them myself I may get lucky.

-- Brian
[LG V20 Guides, News, & Discussion] ChazzMatt:
Good move, confusing LG security spies about what you actually did. "Pretending" you don't know. ;)

Ooops. Should have sent that as a PM.

Sent via open market LG US998 V30/V30+
[LG V20 Guides, News, & Discussion] dudeawsome:
Take your time your almost there also thanks a ton for your work.
[LG V20 Guides, News, & Discussion] TheDannemand:
Thank you, best laugh today :D

I can completely imagine how frustrating this must be. But by all means post (or don't post) as you feel like. As [MENTION=5070414]Josh McGrath[/MENTION] wrote in his excellent response, don't worry about frustrating others: You're doing this amazing work from which everybody will benefit, so just post whenever and whatever you want to share -- even including frustrations that need venting.

From my own experience with reverse engineering (in a different era) I will say this: Don't forget to take breaks and eat and sleep. Go look at some trees or something. I'm serious, really LOOK at them, it helps. If you find yourself waking up at night wondering "what opcode am I running?" or "which partition was that?" that's your mind telling you you need more breaks.
[LG V20 Guides, News, & Discussion] Josh McGrath:
[MENTION=3167089]runningnak3d[/MENTION]

I don't know why that guy won't post what program he was using, but would you be able to tell with a log if we tried recreating it?

There's only a handful of progs that he could use right? Lgup, uppercut, etc so we could possibly find out which he used, correct?
[LG V20 Guides, News, & Discussion] runningnak3d:
I figured out from the sniff he used an Octopus (Octoplus) box.

How he flashed isn't as important as what he flashed. If I knew that I could gather information from the partition listing. He flashed on an LG Stylo 2, so I have already grabbed the hardware info on that phone, but again knowing the partition, would give insight as to how big it is. For example the 0x2fe00 that is unk2 in the COPY could be the max size of the partition. Without more details it makes it hard. I can't believe that someone wouldn't give out the details.

Oh well, I will crack this. It is just a matter of if I can crack it before LG patches it.

-- Brian
[LG V20 Guides, News, & Discussion] J Bee:
Awesome work Master:good:
[LG V20 Guides, News, & Discussion] Addiso:
I have a v30 still on 10b waiting to test as well if I can be of any assistance.
[LG V20 Guides, News, & Discussion] steadfasterX:
btw dunno if I mentioned that but I have not just Infinity but Octoplus, too.

If needed/useful we can do even a remote session and you can flash on your site while we are connected.

.
[LG V20 Guides, News, & Discussion] utka:
you're amazing! thank you for all the hard work you're putting into this!
[LG V20 Guides, News, & Discussion] Josh McGrath:
[MENTION=3167089]runningnak3d[/MENTION]

That guy who posted his logs, do you know where he is from? His English is pretty bad. But if he's from China, you'll probably never hear back as they are blocking people from releasing exploits so the govt can use them for themselves.
[LG V20 Guides, News, & Discussion] quanqw:
I don't understand.
[LG V20 Guides, News, & Discussion] BadToThePhone:
Can I ask how the testing is going? Good luck
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=5070414]Josh McGrath[/MENTION] No idea where he is (was) from, but yea, I am pretty sure he won't post any more details since he pulled the info that he had posted. Luckily I grabbed the sniff before he pulled it.

I have decided to step away from this for a few days -- sorta. The sniff that he posted isn't a standard pcap, it is an HTML dump from HHD Software Device Monitoring Studio. Unfortunately I couldn't find anything that could easily convert this to a standard pcap, so I am writing a little tool to extract the data that I need. Once I get it extracted, I can recreate what he flashed, so I will know exactly what it was, how big it was, etc.

It just would have been much easier for him to TELL me than for me to have to go this route. I don't mind doing the reverse engineering myself -- he didn't need to provide the complete solution, just answers the the couple of questions that I asked.

If a successful flash hadn't been done, I would have given up -- especially if I would have bricked my phone again. Since I know it is possible, I will tackle this, but I just need to walk away for a few days.

I am doing research on fusing versus non-fusing devices when it comes to ARB. There is a qfuse that must be blown to enable the PBL to utilize ARB. The only way to blow it is with a programmer (firehose), it is in a part of QFPROM that isn't mapped to an area that can be *written* to by ANY part of the TurstZone (just like the RSA key). So if you have a non-fusing device, then you will never have to worry about ARB.

What I am trying to figure out is are ALL devices of a given model (for example all H910s) or was it just a batch that made it out without that qfuse being blown.

LG really screwed the pooch on the V20 security wise. I mean all models except the H918 having the same RSA key, and now it looks like a lot (or all) of certain models don't respect ARB, and there is no way to fix that outside the factory :)

The LS997 and the H918 are AFAIK (please correct me if I am wrong) the only models that have any kind of real security, and that is because both Sprint and T-Mobile roll their own firmware. I mean T-Mobile went so far as to have their own RSA cert to sign their firmware -- hence the need for a different key in the CPU.

-- Brian
[LG V20 Guides, News, & Discussion] Eliminater74:
I been following your progress and yeah man, Take time away, Dont burn your self out.. I been down that road before. I always end up taking a few months because I burn my self out so bad

I dont do the kinda stuff you do. that is out of my ballpark of knowledge, I am strictly a devloper of Rom, kernels, and Toolchains (clang also), and I know what it like to burn your self out..

So take your time and work at your own pace, anyhow thanks for the good work you have done and the much more your willing to do......
[LG V20 Guides, News, & Discussion] Josh McGrath:
[MENTION=3167089]runningnak3d[/MENTION]

I didn't want to quote your whole post but don't even sweat it. I honestly would actually prefer till June when the new LG top tier is released. I tried looking into the laf last night and i.cant figure python out to save my life.

Can you send me a pm, I have something that might help. This stupid buggy app won't me pm.
[LG V20 Guides, News, & Discussion] johnmurrayvi:
It looks like it's hardcoded to look in both "/storage/external_SD/SystemUpdate" and "/data/local/tmp" (and the FOTA process also checks "/cache/update.zip" and "/cache/fota/dlpkgfile"). I would assume the indirect flash gets written to the misc partition via MISC WRTE and needs to be flushed/written to the actual target partition after that.

If you get a chance, can rehost the capture from xnoxcdm some where? Also, could you repost the capture from your comment here? I've primarily been disassembling the partitions and DLLs and haven't looked at much in terms of captures yet.

Appreciate all the work you've done!
[LG V20 Guides, News, & Discussion] runningnak3d:
Man I would love the help. I won't post a lot of my work publicly for obvious reasons, but I will send you a PM with a link.

We also have an IRC channel on: irc.freenode.net #lglaf

-- Brian
[LG V20 Guides, News, & Discussion] BROKEN1981:
Correct me if I'm wrong, but I thought your H910 was rooted and your H918 was not.

Could it be you thought you pushed twrp on an already rooted device?

I could have sworn pages ago you said the H910 was rooted.
[LG V20 Guides, News, & Discussion] runningnak3d:
The H918 was bricked (details are in this thread, but it was from playing with COPY) a while back and I had to send it to LG. When I got it back it was on 10s so no longer rootable.

[MENTION=2448653]johnmurrayvi[/MENTION] You have already helped. I am an idiot. I have no sniffs of flashing a partition that has a *bak .. for example recovery. All of my sniffs have been flashing boot or system, since it was easy to restore my phone.

I will bet my phone that COPY is used to copy *bak to the actual partition. So, just need to sniff flashing recovery and see what shows up.

Also, unk argument in the COPY opcode is very likely the offset of the misc partition.

You have given me a lot to think about just from your post .. thanks.

-- Brian
[LG V20 Guides, News, & Discussion] runningnak3d:
COPY fd_num,src_offset,dst_offset,size

W00T

The offset is in blocks, and UFS blocks are 4096 bytes.

Still have to figure out IOCT to enable copying, but this is a lot closer tonight.

I am still astounded that I didn't brick my phone by sending a list of values.

Actually, I'm not, the destination offset was correct, so there was no chance of me overwriting something important .. but that was still luck.

-- Brian
[LG V20 Guides, News, & Discussion] BadToThePhone:
Is there still a possibility to root the h918? Thanks
[LG V20 Guides, News, & Discussion] runningnak3d:
Sorry for the stream of posts.

In old versions of lafd, first an important partition like aboot would be written to abootbak. Once it was verified, it would be copied to aboot, and verified again.

In current versions of lafd, the COPY opcode has been pulled in favor of using a temp buffer, and write mode 0x29 to flush it. This causes what was flashed to be hash checked with the hash that is sent in the SIGN opcode.

In other words this is how TOTs we're flashed. Since they have no SIGN payload.

Luckily we can flash older versions of laf.

Screw taking a few days off, I just needed some inspiration :)

-- Brian
[LG V20 Guides, News, & Discussion] nickland:
[MENTION=3167089]runningnak3d[/MENTION]

Ferris Bueller, you're my hero. Never dove into learning any sort of programming but this has been a fascinating thread to follow. Thanks for all the hard work and above the call of duty sharing of knowledge. Can't wait to see you with fists raised and a boot planted firmly in the corpse of this endeavor.

Inspiring shizzz. All for the thrill of solving an unknown for a labor of love.
[LG V20 Guides, News, & Discussion] Josh McGrath:
I think we should get a bounty going for your work. I don't have much, but I'm down for 25.
[LG V20 Guides, News, & Discussion] runningnak3d:
So, that unknown in MISC WRTE is the offset in the misc partition. lafd already knows the offset of the misc partition, so you take that offset, and add the offset passed to MISC WRTE and you get the final offset that needs to be passed as src_offset to COPY.

So, that leaves IOCT which may not even be an issue since we have the payload to pass to OPEN is rw mode.

-- Brian
[LG V20 Guides, News, & Discussion] Addiso:
I'll match that myself.
[LG V20 Guides, News, & Discussion] runningnak3d:
While I really appreciate it guys, the reason I don't have a donation link is because I am one of those hippy open source dudes. I could not in good conscience take money for something that *SHOULD* have been open for anyone that wanted it.

I live in Largo, FL .. if you are ever down this way, just shoot me a PM and you can buy me a beer :)

-- Brian
[LG V20 Guides, News, & Discussion] quanqw:
Is this your mod for v20s?
[LG V20 Guides, News, & Discussion] musiceas66:
The very fact that you care this much about truly free and open source material should be enough in itself for some monetary thanks. Even if it's just for beer, we really appreciate your time and effort.

I've been following along with this thread for quite some time and you're such an inspiration! We're all rooting for you, though I suppose you're really the one rooting for us.
[LG V20 Guides, News, & Discussion] Josh McGrath:
Well it's not open source, and you're the one doing the work that makes me go crosseyd so you should get paid if you ask me!
[LG V20 Guides, News, & Discussion] SJMarty:
+1
[LG V20 Guides, News, & Discussion] matt4321:
Thread cleaned, please be civil with one another!

Matt

Senior Moderator
[LG V20 Guides, News, & Discussion] johnmurrayvi:
Not a problem, that's understandable. I'll be away from my main machine and tools for a day or two and re-setup my IRC client when I get back.

Haha I can totally understand that sentiment, definitely been there before. Don't overwork or over-stress yourself though!

Nice job! Those arguments definitely would make sense. I've been digging through V30 related files/partitions, but I'll try to get ones that are more related to what you're working with. At least for the DLLs, I haven't found much related to the IOCT command.
[LG V20 Guides, News, & Discussion] ph4nt0m117:
Shut up and let us buy your lunch.
[LG V20 Guides, News, & Discussion] runningnak3d:
So after parsing the GPT from the sniff:

Start misc - 0x50000 / 327680

End misc - 0x53FFF / 344063

COPY source offset - 0x4FE00 / 327168

Size - 0x16000 / 90112

COPY destination offset 0x7C9B88 / 8,166,280 This one really makes no sense, and I can't find anything that matches. The closest is:

Start carrier - 0xFC000 / 1032192

End carrier - 0x83BFFF / 8634367

So towards the end of the carrier partition.

What was flashed is an ELF binary that has something to do with Octopus.

The carrier partition on the V20 is blank. There was also an EXEC sent. So it looks like whatever was flashed was then forced to run. I am guess that this was either for a SIM unlock, or changing the IMEI ... anyway, it doesn't matter. He wasn't flashing a normal partition.

Based on this, I am convinced that I am correct and it is:

COPY fd_num,src_offset,size,dst_offset

This is verified for MISC WRTE:

MISC WRTE misc_offset,size

So again, as a test:

MISC WRTE,0xf80,10 0123456789
MISC READ,0xf80,10
0123456789
exit

Now let's dump the misc partition and see where that is...

It is at offset 0xf80000 within the misc dump. So, another question, why copy the entire misc partition? Unless he had nulled his misc partition, and the padding at the beginning didn't matter. The src_offset should have been misc_start + misc_offset from MISC WRTE.

So I finally decided I would do a little test. I am no longer getting a write error, but it doesn't seem to actually write. This leads me to believe that IOCT must enable the block device for copying.

[LAF] start laf copy2
[LAF] copy partition 1 0x7f86000 0x0 = 0x7f86000

-- Brian
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=2448653]johnmurrayvi[/MENTION] We will probably have to go back to MM or even LP to find a DLL that might have IOCT in it -- it is definitely not in any Nougat DLLs. There is also a chance that it isn't going to be found at all because it is for use by an internal tool. Decompiling lafd doesn't give much insight into what the possible parameters could be.

I did finally figure out what indirect flashing is, and exactly how it is used, but it will only flash a KDZ from an sdcard. Which you can do that by pulling the USB cable while in DL mode, tap the power button 4 times, it will say waiting for any connection. You then slide your SDcard in with your KDZ in /SWupdate -- and it starts flashing. All the limitations of the SIGN opcode still apply.

So again, we have:

* Normal flashing - KDZ

* Indirect flashing - SDcard / KDZ

* copy2 flashing - Total abuse of MISC WRTE

So copy2 it is -- again, I know it works, it is just a matter of figuring out IOCT now.

-- Brian
[LG V20 Guides, News, & Discussion] draymond1987:
Hey [MENTION=3167089]runningnak3d[/MENTION]! So I really am not sure how I can be of assistance with your progress. I can follow directions and am not afraid to flash things, as long as a hard brick doesn't occur. I've got an LG V30 (US T-mobile) and I did unlock the bootloader. I guess I got lucky, as I have read some adb / fastboot commands were blocked, but I only had to use "fastboot oem unlock". I know on the website, it says to do X amount of steps, which I was following, but then the ID command didn't work?? Anyways, that all doesn't matter!

Sorry if I'm on the wrong thread, as I seen you on another thread, specifically for the V30. This one seems more active. Also, let I said, I have some knowledge of what I'm doing, if following instructions. I definitely know there are WAY more skilled developers and people in this thread, so I do not want to seem any type of way.

Major respect to you and everybody in this community!
[LG V20 Guides, News, & Discussion] runningnak3d:
Thanks, I really appreciate it, but right now what I need are people that know reverse engineering -- specifically arm64 asm.

I mean if I have to, I will just send sequential numbers for IOCT again. I can do a READ after each one is sent to see if the recovery partition has been updated. Brute force it :)

-- Brian
[LG V20 Guides, News, & Discussion] Zacharee1:
Script it!

I know Smali, but that's about as low level as I've gone so far.
[LG V20 Guides, News, & Discussion] runningnak3d:
That is exactly what I am going to do. Try to write "It worked!" to the carrier partition, the do a read and strcmp the result.

-- Brian
[LG V20 Guides, News, & Discussion] Nickvanexel:
Hey. Probably very off subject here but I just got vs988 lg g6. Its on an old 2017 security patch, but there doesn't seem to be a root method for the verizon g6 due to verizon bootloader being locked. Does this whole engineering a boot and root method work on my g6? Just trying to confirm weather I should just go ahead and update the phone to latest firmware if it doesn't matter anyways.
[LG V20 Guides, News, & Discussion] runningnak3d:
Dump your aboot and I will compare it to the V20 aboot. There are a LOT of ifs, but LG has made major mistakes with the V20.

If the RSA key in your CPU is the same

If all your firmware can be loaded by the V20 aboot

If the Jupiter has aligned with Venus

etc

Then sure :)

Seriously, if you post a link to your aboot, I will take a look.

-- Brian
[LG V20 Guides, News, & Discussion] Josh McGrath:
Has any of this LAF testing you've done had any effect on possibly using the flashall fastboot option?
[LG V20 Guides, News, & Discussion] runningnak3d:
flashall just uses flash. If flash is disabled, then flashall is also disabled even if you get a reply back from the bootloader making it LOOK like you still have flashall -- it will never be able to actually flash.

fastboot update is the same way...

-- Brian
[LG V20 Guides, News, & Discussion] ClockworkImpulse:
If you need help with ASM I know x86_64. Could be of some use to you.
[LG V20 Guides, News, & Discussion] TheLogicalGamer:
Glad I held on to my V20 after my replacement came back with 10p. Can't wait till you've got it figured out, and I can start playing around with aosp on the v20. I'm currently using my old g3. But what you're doing is waaay outta my wheelhouse. I'll provide any help I can. Just wanted to say thank you for all the hard work! :)