yashsingh1/xdaforums huggingface dataset:
[LG V20 Guides, News, & Discussion] Tilde88:
That is way too high for a board.

[MENTION=3167089]runningnak3d[/MENTION] what i did, was buy a cracked screen H918. I made sure the description said ESN was clean, and that everything worked on the phone (especially boot-up, and touchscreen). I made sure to have one that had pics of the actual unit. If anything was wrong from what was stated, I could return it through eBay guarantee.

I ended up paying $90 for the phone, and swapped the board to my good screen. Works perfect, and sure enough ESN is clean. Even got a 2nd battery now :-p.

Here's what I got

https://www.ebay.com/itm/LG-V20-H91...e=STRK:MEBIDX:IT&_trksid=p2057872.m2749.l2649
[LG V20 Guides, News, & Discussion] dimm0k:
you should definitely throw up a donation link... if not now, definitely when you crack this because then it won't just be the LGV20 users that get to reap the benefits of your sacrifices
[LG V20 Guides, News, & Discussion] diehard2013:
has anyone successfully rooted an H915 (freedom mobile) using this method?

thanks!
[LG V20 Guides, News, & Discussion] Zacharee1:
There is no method...

This is a progress thread.
[LG V20 Guides, News, & Discussion] Snakecharmed:
I bought a US996 after finding out that recent firmwares for the H918 couldn't be rooted, but I'm still watching this thread with great interest because I do lose some T-Mobile exclusive calling features with the US unlocked version of the V20. I'm looking forward to and rooting (derp) for runningnak3d's success, as it may bring me back to getting an H918 after all.
[LG V20 Guides, News, & Discussion] BROKEN1981:
He will crack this open. Just hope he throws up a donation link for all his frustrations at our benefit.
[LG V20 Guides, News, & Discussion] storm68:
+1

---------- Post added at 12:06 AM ---------- Previous post was at 12:05 AM ----------

I smell something cookin'. :laugh:
[LG V20 Guides, News, & Discussion] Snakecharmed:
Yeah, it's looking good. Post #306 says it all. It turns out that maybe I shouldn't have cancelled my original H918 purchase, especially since I'm beginning to see that not every unmodified H918 that's being put up for sale is on an ARB=1 firmware even though you'd think most of them would be by now.

Like really, my second G4 couldn't have waited another week or two to bootloop itself to death?
[LG V20 Guides, News, & Discussion] Zacharee1:
LG takes great pride in its ability to inconvenience its consumers as much as possible.
[LG V20 Guides, News, & Discussion] Snakecharmed:
Indeed they do. My love-hate relationship with LG is on a completely different level compared to HTC before all their One nonsense. I really would have liked almost any other manufacturer to have created the last easy-to-disassemble flagship with removable everything. LG has been a model of incompetence post-G4.
[LG V20 Guides, News, & Discussion] Dd311:
Hey im a bit late to the research party but im willing to help as well i have the h918 with arb1 as well. Ill do anything that I can to help and i can send you all the info from my SVC menu and what not. I'm new to the world of programming and Advanced android tinkering as well as some more hardcore PC tinkering, but I can do anything you can walk me through on though!

Just let me know if i can help! Also thank you for all your work man, It's incredible what you all do here and i hope to soon be able to do these kinds of things as well!

EDIT::: BTW I got $25 on a donation for the time and effort w/e you decide to throw up that link or what have you : D
[LG V20 Guides, News, & Discussion] BadToThePhone:
Good luck with this. This would be incredible. Everyone's hard work is really appreciated.
[LG V20 Guides, News, & Discussion] Tilde88:
[MENTION=3167089]runningnak3d[/MENTION] already confirmed that he has this done. Once he gets his phone fixed up, he will test to reduce the likelihood of bricks, and release for us :). Just keep that F5 button handy lol
[LG V20 Guides, News, & Discussion] runningnak3d:
I will know tomorrow if LG is going to honor my warranty, and it looks like they will. Yep, that will make the fourth brick that will have been repaired in my quest to truly understand LG security (well, this last one was just flat out not paying attention -- 100% flake out because I was so stoked). As soon as LG emails me a date, I will post it....

I have a lot of code to clean up, but more importantly I need to test it again, but then it will be ready for use.

Whatever you do, don't take any updates. As of v10r the exploit is still possible, but as I stated in another thread, the exploit has already been removed from the lafd that the V30 uses, and I am sure that the next major update for our phones will include that update.

-- Brian
[LG V20 Guides, News, & Discussion] Zacharee1:
If there is a next major update for the V20, that is.
[LG V20 Guides, News, & Discussion] dudeawsome:
As for the h918 the next update should be Oreo according to lg
[LG V20 Guides, News, & Discussion] Zacharee1:
Yeah, but when are we getting that? The date I heard was after the public beta release of Android P.
[LG V20 Guides, News, & Discussion] dudeawsome:
No around March and April
[LG V20 Guides, News, & Discussion] Zacharee1:
O DP1 was April 5.
[LG V20 Guides, News, & Discussion] dudeawsome:
Ahh welp then you might be right we will just have to wait and see
[LG V20 Guides, News, & Discussion] Tilde88:
LG wouldn't flash my 9008 because they found water damage... even though i never got the phone anywhere near water...

When I received it, i opened it, and sure enough you could see a small drop of water on the board. I asked them to flash it anyway, that I'll sign a waiver confirming that I knew this wasn't a 100% fix, but they refused. And yes, the phone worked perfectly prior to the brick. It was just an aesthetic issue that showed water was on the board.

I'm definitely never buying anything LG ever again, even though they have the best screens (for TVs) at the moment. The fact that they wouldn't flash my perfectly good phone, and leave me out to dry, short $1000.... (phone was 4 days over the TMobile warranty). I ended up fixing it as you know with a new board but they should have flashed it.

That, and their kernel sources are so friggin ugly. Things indented improperly, or missing indent altogether. There are even some parts of the kernel source that you can tell they selected a whole section, and dragged it with the mouse, to screw up the ordering.

Then they go and start locking things down for their devices (aside from the TMobile lockdowns). I can get wanting to keep devices from being botched by end-users, but you can't just lock people out... So if I buy an HP, I can't choose to format it and run Linux? Or maybe a better scenario... I bought this new Windows PC. And it can never have administrative rights... That's absurd. LG Mobile can drop dead for all i care. Any flagship manufactures that do this as well. Samsung, whomever....

After the V20, never again will I buy anything LG.
[LG V20 Guides, News, & Discussion] storm68:
+1

I'm on TMobile on the jump program and as soon as the S9 comes out I'm jumping ship. That's if I can root it. Having flash withdrawals suck big time! :silly:
[LG V20 Guides, News, & Discussion] runningnak3d:
Little off-topic, but [MENTION=2933708]storm68[/MENTION] you might want to check the status of the S8 and S8+. As far as I know, they only have system root, and no recovery, and the only reason they have that is because someone got an engineering boot which had dm-verity disabled. It is still signed, so you don't need an unlocked bootloader.

I can't say this enough. I know it is a lot easier for some people to buy phones from the carrier so you don't have to shell out 700, 800 or God forbid $1000.00 on a phone, but things are only going to get worse as far as locking phones down. I don't have my demo unit yet, and when I get it, I will post the ACTUAL details, but it is my guess that when the SD845 is released, the only thing (as an "end user") you will see is what we know as boot, system, userdata, cache and MAYBE modem. The entire TZ will be on the CPU and encrypted. The only avenue for attack will be if you have physical access to the chip (look up the work that is being done to hack the Nintendo Switch). I am not saying that it can't be cracked, but the best that an ordinary person will be able to hope for is an engineering boot leak like the S8 and S8+ -- be that LG, Samsung, HTC, Motorola, or any other OEM that wants to completely lock their phone down.

Even OnePlus will probably have problems giving people access even though they will WANT to. It is the design and security implementation of Qualcomm.

It is my hope the Exynos or Mediatek up their game as far as performance goes -- but at the end of the day, I will take a slower phone that I can root over "fast as crap" that I have zero control over.

-- Brian
[LG V20 Guides, News, & Discussion] storm68:
Oh I see. I didn't know that about the S8. I've been on their forums but at a quick glance. Didn't realize there was no TWRP. If and when you get this going on root for 10r, them I would have to seriously say I'll stick with the V20 with no update, of course. Especially since it's a pull out battery and also the sense that I can put in a micro SD card for hi storage volume. The camera is really nice on this phone and still keeps up with the latest. So yes, your advice will be taken in regards to your info. Thanks :good:
[LG V20 Guides, News, & Discussion] Tilde88:
Truer words have never been spoken. I've always been a pure QC "fanboy" but as you say... It looks bleak.
[LG V20 Guides, News, & Discussion] BROKEN1981:
I have mixed feeling right now. I love the quad DAC so I would always want an LG. I had root on the v20, but figured I did not care about it till I could not have it.

Right now, if I had root I wouldn't know what to do with it.

If I could theme my nav buttons, then I would love that.

Running a custom ROM such as LOS just seems foolish. Lose the quad DAC and second screen. The selling point of this phone is the second screen and Quad DAC. V4A kills audio quality. Also stock ROM is fast and fluid.
[LG V20 Guides, News, & Discussion] popwar:
V4a kills audio quality? It was amazing paired with dac on the v10. Just have to find the right settings.
[LG V20 Guides, News, & Discussion] jimenezboy:
V4A is a really nice mod once you find the correct settings for it.
[LG V20 Guides, News, & Discussion] BROKEN1981:
V4A does not work with the quad DAC. It down samples.
[LG V20 Guides, News, & Discussion] Stransky:
Hi

I have a Verizon VS995 unlocked bootloader (used DirtySanta) rooted with Supersu and running Alpharom 1.5.2 (v99518a) stock. If I can help feel free.
[LG V20 Guides, News, & Discussion] BadToThePhone:
Would it be beneficial to get a V20 to another dev to help out?
[LG V20 Guides, News, & Discussion] Masterfireheart:
V4A isn't what downsamples, Android does. And downsampling (to 48KHz of all things) is actually beneficial to reducing post-nyquist aliasing and by extension any harmonic distortion as a result of the streaming.

The actual dynamic EQs and filters it does offer DOES work wonders on improving sound quality though (it has nothing to do with hardware), its all a matter of you tweaking the settings to find what's right for your setup.

Also hi everyone! Decided to finally make an account after lurking this thread for a few months (I went by paulbeenis on the IRC channel if anyone remembers). Excited to see all the progress being done for the V20 and I hope I can help in any way (though my expertise is in audio, not kernel exploits lol)
[LG V20 Guides, News, & Discussion] BROKEN1981:
Actually V4A is downsampling. It's an Undisputed fact. But hey, people will defend their mods no matter what. There are many threads on this subject.

---------- Post added at 06:40 PM ---------- Previous post was at 06:30 PM ----------

https://xdaforums.com/v20/themes/increase-lg-v20-hi-fi-dac-quality-t3724489

There. That's the short version. People need to just research for themselves and don't follow anything blindly just because some random person said something over the internet.

If you like V4A, great! It's a fact it kills audio quality. I'm only taking facts here, not subjective taste in sound.
[LG V20 Guides, News, & Discussion] Zacharee1:
Careful how you use words. Quality doesn't necessarily decrease, because quality is pretty subjective. Fidelity, however, does go down.
[LG V20 Guides, News, & Discussion] jimenezboy:
I fell in love with V4A while using the indestructible LG G2. The app made the phone's tiny speaker sound so much better, and as a basshead the mod really kicked up the bass using headphones. The H918 V20 I have at the moment has no V4A simply because I can't really use it because of its sim-locked status.
[LG V20 Guides, News, & Discussion] BROKEN1981:
Very true
[LG V20 Guides, News, & Discussion] Zacharee1:
Anyway, maybe we should stay on topic. This thread is about LAF.
[LG V20 Guides, News, & Discussion] storm68:
I guess this is just nearly impossible. So pissed at LG, bastards!!! I literally feel like throwing my phone into the toilet!! I cracked my screen on rooted one, got my replacement and Bam it's 10r. Been like that for a month or so now. I completely lost hope on LG! first time ever in the last 15 years I've been with no root...... So pissed.
[LG V20 Guides, News, & Discussion] Tilde88:
It is not impossible... Yet.

runningnak3d already got write access to the phone. he has stated various times that once he gets his phone back from repairs, he will finalize the tool to reduce risk of bricking, and release to the public.

he also mentioned not to update passed 10r JUST IN CASE.

Edit: Also, you can blame T-Mobile... Not LG. LG can be blamed for the V30 lockdown (as well as TMO).
[LG V20 Guides, News, & Discussion] runningnak3d:
Well holy sh*t! I blew the tamper fuse and they STILL fixed it under warranty:

If it takes as long to get back as it did to get to them, I should have it back Thursday. w00t.

I was sh*tting my pants when I got the news the tamper fuse was blown. They actually replaced the CPU.

LAFSploit -- coming soon(c)

-- Brian
[LG V20 Guides, News, & Discussion] BadToThePhone:
Did you make any new discoveries with the phone with the blown cpu? Thanks
[LG V20 Guides, News, & Discussion] BAFLGV20:
Here's just a little view into what it takes to break this wide open!

Just Google (Secure Boot and Image Authentication) and download the pdf.
[LG V20 Guides, News, & Discussion] jimenezboy:
It's a very heavy-handed approach from whoever came up with the idea to have the cpu blow up because of incorrect firmwares. come on qualcomm, your chips are being used on phones. i might be wrong, but i guess some actually important installations like some medical devices etc run on chips that are not as locked down as the new qualcomm chips. class move though by lg replacing the CPU, it redeems them a little for the numerous times they've stabbed us in the back.
[LG V20 Guides, News, & Discussion] storm68:
Yeah I think he's waiting on his phone. I'm still waiting for the update.zip but I think he doesn't want anyone to be in his position in case something goes wrong. Which I completely understand.
[LG V20 Guides, News, & Discussion] whojabacod:
https://github.com/Lekensteyn/lglaf
[LG V20 Guides, News, & Discussion] Snakecharmed:
I finally got my near-mint H918 today and it looks like it's miraculously still on 10j fresh off a factory reset although a notification said that an Android System Update is available. I'm not taking the update; in fact, I blocked the notification from Google Play Services and I'm not going to connect it to the Internet or put my SIM card in until all this is done.

I'm still curious to see what the process is like for LAFSploit versus dirtycow, but logic would probably dictate that I should just go root via dirtycow now because I can.
[LG V20 Guides, News, & Discussion] dudeawsome:
You you know you could just root it now and don't have to wait I did it on 10j and I'm running 10r through a flash able zip
[LG V20 Guides, News, & Discussion] Snakecharmed:
That's most likely what I'll do. I didn't expect to have the phone delivered today, but I'll have to find some free time during the week to get it done. I'm just glad I can go ahead with returning my unused US996 now. Not seeing this thread first before cancelling my original H918 order and subsequently ordering the US996 set me back a week.
[LG V20 Guides, News, & Discussion] dudeawsome:
Ahh I see as long as your up at 10r this is said to work just gotta wait for him to get his phone back Thursday he said and then he'll clean up the code and ready to deploy the rootmethod
[LG V20 Guides, News, & Discussion] runningnak3d:
No, I didn't even know that the tamper fuse was blown. I thought it was bricked strictly due to me flashing the H910 aboot onto my H918 (the RSA key is different). That was one reason, but apparently I had also tripped the tamper fuse completely by accident. There are a few opcodes that interact with the TZ that I *thought* only READ values. I need to look at the decompiled code a little better :)

This isn't attempting to get around AVB (Android Verified Boot) -- we have unlocked bootloaders. The H918 can unlock from the factory, and there is an engineering aboot for all the other models.

This is getting around LG's signature verification for flashing -- something completely different.

-- Brian
[LG V20 Guides, News, & Discussion] BAFLGV20:
Secure Boot and Image Authentication pdf.

The pdf contains chain commands and how the keys are written. also how the e-fuse is implemented . just thought it could be useful and help others understand.

---------- Post added at 05:20 PM ---------- Previous post was at 05:08 PM ----------

I do hope this LAFsploit is able to do us justice. I can't stand the way LG has there thermals set. after 5mins. the lag in games and intensive tasks are killing me. When i know the SD820 and Adreno 530 are capable of so much more with the thermals set right. Carelessly, i updated my H918 to 10r. thinking the update would improve performance.

I thought this was pretty interesting being that the fuse was tripped. This is just a couple paragraphs that are in the pdf.

Like most digitally signed software, these image signatures include a certificate chain. The “Attestation certificate” refers to the

lowest level certificate authorizing the signature of the software image. This certificate is signed by the “Attestation CA certificate”

which is in turn signed by the “Root CA certificate”. The Root CA certificate is validated by computing its hash and comparing to

a value stored either in eFuse or in ROM (eFuse is a set of hardware embedded one-time programmable bits that once “blown”

cannot be reverted). This stored Root CA hash value is provisioned to the device by the OEM .
[LG V20 Guides, News, & Discussion] storm68:
Looks like there's another update coming 10s
[LG V20 Guides, News, & Discussion] runningnak3d:
8:42 am	On FedEx vehicle for delivery	SAINT PETERSBURG, FL

6:34 am	At local FedEx facility	SAINT PETERSBURG, FL

Schweeeeet.

So that means that 10s will get dumped if that is what is on the phone. I will also factory reset my H910 and be dumping 10t. But most importantly, can hopefully wrap this up in the next day or two.

-- Brian
[LG V20 Guides, News, & Discussion] Tilde88:
We can only hope that if it is indeed 10s, that LAFsploit isnt fixed. o.0 lol
[LG V20 Guides, News, & Discussion] SJMarty:
Don't even say that! :eek:
[LG V20 Guides, News, & Discussion] ph4nt0m117:
So uh. Can I root an LS997? I'm looking back through the thread and trying out some stuff like the update stuff built in to the phone and I don't have a download mode, jjust a factory wipe and the bootloader that LG packed in. Just curious. Been looking for how to do this for about a year now and foolishly let my phone update to ZVB... I kinda hate myself at the moment.

@ OP if you need a tester for LS997 I'm all yours. I'm a bit of a hacker on this stuff and I'm trying to learn all I can to hopefully dev some of this myself. Been working on a Nextbook Ares 8 to start with. :)
[LG V20 Guides, News, & Discussion] runningnak3d:
So, just an update, we aren't there yet. I was correct that it does write, but I was also correct that it isn't correct (yet).

[MENTION=5545101]steadfasterX[/MENTION] Did some testing and bricked his phone. Luckily he has the tools to unbrick it -- so he is now the guinea pig :)

But this is good news. If the phone can be bricked, it means that it IS writing, we just need to figure out the correct parameters to make it write where we want it to. This is actually major progress.

It also occured to me that I don't need risk my phones per-se, I can use the SD card as the block device. I have created a partition table on my SD card, and if I can read back exactly what I wrote, where I wrote it, then I know it is safe to try on an actual phone.

I know know there are people that really want to root their phones -- all I can say is hang in there. I will be fighting with this pretty much day and night till it is solved.

-- Brian
[LG V20 Guides, News, & Discussion] spawningvat:
Hey Brian, When you say not there yet, are you talking about rooting the h918, or that we can't root the h910 v10t yet?

I have an h910 on v10t (thanks to a forced fota from ATT). I read the OP many times, and started downloading everything to prep for the root. V10t is still ARB 0, so I was thinking it may work. Didn't try anything yet tho.

Should I hold off?

Sean
[LG V20 Guides, News, & Discussion] runningnak3d:
The H910 is rootable on 10t -- just follow the H910 root procedure, and you will be good. I have not had a chance to reset my phone and dump 10t yet, so you will be on 10r.

This thread is for the models that can't root by reverting to older firmware -- like the H918 and LS997. I mean when it is done it will work on any model, but those guys are really in a hurt since they can't root at all right now.

-- Brian
[LG V20 Guides, News, & Discussion] steadfasterX:
Oh and btw:

COPY is limited (at least in my case) to 256 KB! If I specify a bigger value it will be set to 256 KB!

Tbh it still makes not much sense to me.. Is COPY a rewrite of WRTE? If so why? If not: what's the purpose? Especially when it is such limited...

And to go further: it makes not much sense to do a WRTE on the partitions offsets and then doing a COPY again?! I will investigate that further next week....
[LG V20 Guides, News, & Discussion] runningnak3d:
I don't think it is meant to replace WRTE, it is meant to be used in conjunction with RSVD IDDD for indirect flashing.

FYI IOCT fd_num,2 turns off write protection when using RSVD IDDD.

-- Brian
[LG V20 Guides, News, & Discussion] storm68:
Is testing being done using 10s now? Or still 10r?
[LG V20 Guides, News, & Discussion] BAFLGV20:
From what I've gathered so far, it's 10p and 10q but 10r is also ARB1. so as long as we sit and be patient I think good things will happen.
[LG V20 Guides, News, & Discussion] ph4nt0m117:
So, when done, what is the process of the root? Just a couple scripts?
[LG V20 Guides, News, & Discussion] BROKEN1981:
We aren't there yet, so who knows.........
[LG V20 Guides, News, & Discussion] storm68:
Lol. Ummmm OK. Not exactly my emphasis to my question. Thanks for the positive thought though.
[LG V20 Guides, News, & Discussion] ph4nt0m117:
Darn.... Well either way I'm eagerly awaiting an update!
[LG V20 Guides, News, & Discussion] storm68:
Any way of just getting root and using flashify instead? Probably a stupid question.
[LG V20 Guides, News, & Discussion] ph4nt0m117:
Thats the point of this thread x3
[LG V20 Guides, News, & Discussion] Josh McGrath:
Quick question here about the efuse. How did you know, and how would they know that the efuse is blown if it "failed to power on" ? (I think that was it. Either way, a hard brick)
[LG V20 Guides, News, & Discussion] BROKEN1981:
Flash fire does not work. Also no support which is lame since if you bought it, ChainFire could give 2 fks less. Don't expect support.

Awesome dev, just support sucks.