[LG V20 Guides, News, & Discussion] runningnak3d:
In case no one wants to read the rest of this post -- unless the private key leaks, this is again no longer possible. I was on crack. That is the only thing that makes sense. We don't need the PUBLIC key, we need the PRIVATE key, and you can bet your a** that is locked up somewhere in LG's safe. I have already checked the key to see if it could be attacked with ROCA -- no go.

With that said, decoding works great, so if I ever DO get the private key, then this will absolutely work.

The sign_hash is an sha1 not sha256 hash of the partitions contained in the payload. So, if you take the SIGN payload and strip out the header and the hash, and remove all the extra padding at the end of the payload -- you take an sha1sum of just those 80byte partition chunks. Now you have your sha1 hash, you encrypt that using the RSA *private* key, pack it all back together, and you have your SIGN payload.

I know this would work, because it works in reverse. I was able to decrypt the sign_hash using the public key, and the sha1 that was generated matched perfectly.

-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6SxdOBDUE0WIy16iflxy
pq0L4G8plxUpZiMmpV3RYaqTYyhq5euOD1EY0gYUXOIj8bewBB9CqXB3KlNqG4xn
UYsHQggTWLI8012o7a3BzR1cpLFkroA9z/WXOyLGtTOTdt/R+v/+DRzsq1AwRGlK
k2KV8xEC5c3551L8Q3g8xZhHLLHzrjZE7yR5ZJ4XOIdSimtvVZ7BIvqbufcxOTvB
X+TglrKTtdYPiC8YLc/63Tz1jyYjZjQVSEbnxgolYJ+s7b1oqNOajEehbN9haA6/
aPNpuYHABLEhb2X6+sM4yUfYxUyx1J+ww2PYAWTX57cUwx0l2IPA5GbDTWOp4BDb
qQIDAQAB
-----END PUBLIC KEY-----

openssl rsa -pubin -noout -text < ~/lafd_public_key.crt
Public-Key: (2048 bit)
Modulus:
00:e9:2c:5d:38:10:d4:13:45:88:cb:5e:a2:7e:5c:
72:a6:ad:0b:e0:6f:29:97:15:29:66:23:26:a5:5d:
d1:61:aa:93:63:28:6a:e5:eb:8e:0f:51:18:d2:06:
14:5c:e2:23:f1:b7:b0:04:1f:42:a9:70:77:2a:53:
6a:1b:8c:67:51:8b:07:42:08:13:58:b2:3c:d3:5d:
a8:ed:ad:c1:cd:1d:5c:a4:b1:64:ae:80:3d:cf:f5:
97:3b:22:c6:b5:33:93:76:df:d1:fa:ff:fe:0d:1c:
ec:ab:50:30:44:69:4a:93:62:95:f3:11:02:e5:cd:
f9:e7:52:fc:43:78:3c:c5:98:47:2c:b1:f3:ae:36:
44:ef:24:79:64:9e:17:38:87:52:8a:6b:6f:55:9e:
c1:22:fa:9b:b9:f7:31:39:3b:c1:5f:e4:e0:96:b2:
93:b5:d6:0f:88:2f:18:2d:cf:fa:dd:3c:f5:8f:26:
23:66:34:15:48:46:e7:c6:0a:25:60:9f:ac:ed:bd:
68:a8:d3:9a:8c:47:a1:6c:df:61:68:0e:bf:68:f3:
69:b9:81:c0:04:b1:21:6f:65:fa:fa:c3:38:c9:47:
d8:c5:4c:b1:d4:9f:b0:c3:63:d8:01:64:d7:e7:b7:
14:c3:1d:25:d8:83:c0:e4:66:c3:4d:63:a9:e0:10:
db:a9
Exponent: 65537 (0x10001)

I am really glad I left the disclaimer that this could still run into a gotcha. I feel like a moron though. PUBLIC -- right there in the key -- PUBLIC!!! *sigh*.

This was still a fun project for me, and if anyone can find an RSA attack, please let me know. We have a LOT of signatures to work with since each KDZ for each different model has a different signature, but uses the same key. So there are attacks out there that could be run -- in a few years.

I am still going to look for an exploit in lafd to force it to accept any signature, but I have zero hope now.

I was actually going to apply for the RD title when this was released, but I don't deserve it without a working exploit. Thanks to all those that nominated me though!

-- Brian

EDIT: I figured what the heck, one more test. I replaced the key in lafd with my own public key from a key pair that I created. I then used the private key to sign the payload -- and viola. It works great. My sign that I create is decrypted and then I can flash. (This doesn't do anyone any good that doesn't have a rooted phone)

EDIT2: To clear up confusion, the test I did with replacing the key can only be done on a rooted phone. It was just to proved to myself that the rest of the reverse engineering had been done correctly.