yashsingh1/xdaforums huggingface dataset:
[LG V20 Guides, News, & Discussion] Tilde88:
Actually, on my linux box, i am now getting "laf_crypto" not defined. I confirmed that pip3 install cryptography and PyUSB were installed. as a test, i went ahead and pip3 install --upgrade pip , but same symptom. thanks again for everything.

putting recovery in download... you are a visionary!

I hadnt thought of flashing 10p, im on 10q. i will do that now. sorry for the bother

update: installing cryptodome fixed it. thanks again, you have done great work!
[LG V20 Guides, News, & Discussion] runningnak3d:
Dude, no bother, I know you know what you are doing, and if you are on native Linux, then you won't have the USB 1.1 timeout issues, etc.

If you haven't done it yet, you don't need to flash back to 10p from q. q has the opcode, and can take the OTA if something goes wrong.

Let me know if you run into trouble.

-- Brian
[LG V20 Guides, News, & Discussion] ph4nt0m117:
Any news on LS997?
[LG V20 Guides, News, & Discussion] jcpowell:
Don't forget [MENTION=3167089]runningnak3d[/MENTION] I've got an LS997 that can be used as a first test device or even a experimental run that might leave it bricked... I'm only holding onto it at this point for that reason.

So I'm a worry free tester for ls997 when you're ready.

Again, you're awesome bro, thank you!
[LG V20 Guides, News, & Discussion] whojabacod:
Adb reboot download
[LG V20 Guides, News, & Discussion] runningnak3d:
We want a way to reboot to download mode without a PC :)

That would open up a bunch of neat things (quick dual booting for example).

-- Brian
[LG V20 Guides, News, & Discussion] whojabacod:
Getting the time out issue in native Linux,

./partitions.py --dump laf.img laf success

./partitions.py --dump misc.img misc success

./partitions.py --restoremisc twrp.img laf. Timeout
[LG V20 Guides, News, & Discussion] Zacharee1:
That doesn't do anything. I've confirmed by trying and looking through services.jar.
[LG V20 Guides, News, & Discussion] whojabacod:
Weird. Bc I legit just used it this morning and it rebooted into download mode for me
[LG V20 Guides, News, & Discussion] Zacharee1:
You used it on an LG phone? If so, that's what's weird.
[LG V20 Guides, News, & Discussion] whojabacod:
Yea, on my h918
[LG V20 Guides, News, & Discussion] ybnrmalatall:
So no one got the update?
[LG V20 Guides, News, & Discussion] ph4nt0m117:
I mean, the 918 is rootable.... Not sure why you keep asking.
[LG V20 Guides, News, & Discussion] ybnrmalatall:
I was under the impression that it was locked after a certain update and arb stopped people from rolling back to a version that can?
[LG V20 Guides, News, & Discussion] dudeawsome:
bc after reading through it is discussing on how to write parts of the kdz file such as /system to the device in since to upgrade without losing twrp.
[LG V20 Guides, News, & Discussion] Vee63b:
Yea, crap. Don't risk it, I'll see what else is out there lol
[LG V20 Guides, News, & Discussion] runningnak3d:
Kdzwriter writes individual partitions from a KDZ file, it does not create a KDZ.

-- Brian
[LG V20 Guides, News, & Discussion] xdav20:
kdzwriter -c writers to /cust partition only

kdzwriter -a writes to /system /cust partitions

kdzwriter -k writes the kernel of /boot partition and /modem

kdzwriter -m writes to /firmware a.ka modem (as stated in documentation)

After using -k flag, before booting to the system you can reflash a custom kernel and install SuperSU again.
[LG V20 Guides, News, & Discussion] Vee63b:
yea lol, saw that part and was like, "crap, back to the drawing board..."
[LG V20 Guides, News, & Discussion] xXCoolGuYXx:
Good luck to you all hope you find a way to root soon
[LG V20 Guides, News, & Discussion] xslugx:
I will have a phone we can use to test with as well I have other phones I can use and currently have a v20 on the 10q
[LG V20 Guides, News, & Discussion] BROKEN1981:
So I have my computer back up and running. I don't have root, am I still able to assist in some way?
[LG V20 Guides, News, & Discussion] aquariuz23:
I really wish I had known about the slowdown bug issue with the LG V20 before I updated to the 10Q update and locked myself out of being able to root :( now this phone annoys me every now and then due to random lag/ system wide slow down. I don't know how I can help, but I'm really hoping that we can achieve root for 10Q soon, or I will have to switch to another phone. Good luck guys.
[LG V20 Guides, News, & Discussion] runningnak3d:
Figured I would post an update on the progress. As some of you may know, I lost ALL of the data I had when one of my drives failed, so I had to start from scratch.

That was a blessing in disguise. I was trying to fully decode EVERY opcode used by LAF. We don't need that, we just need to be able to send boot, system and recovery (H918), or boot, system, aboot, and recovery (all others).

So, with that in mind, I have a bunch of fresh packet dumps of me flashing just those partitions using partition download mode from various versions of the firmware so that they will have different hash values.

Hopefully this weekend I will be able to figure out how to create the hash needed. That is it. I can then create a script that you specify where your files are located, it will generate the hash, and send the files to the phone.

I have both an H910 and H918 to test with, so I can check to see if the hash generation is different between models. I can't imagine that it is, but this is LG. If so, then I will have to ask for help for other models.

Root for all models on any firmware version is coming soon!

-- Brian
[LG V20 Guides, News, & Discussion] black2nd:
I have a VS995 with the september security patch and am willing to do what you need to get relevant info to you.
[LG V20 Guides, News, & Discussion] runningnak3d:
Thanks for the offer, but it looks like it is just an MD5 hash of the image being sent so that LAF can verify that it flashed correctly.

If that is the case, then I don't need to know what the various options and parameters that can be passed to an opcode do, I just send them in the order that LG UP does with the proper hash, and this should work.

-- Brian
[LG V20 Guides, News, & Discussion] storm68:
It looks like to me that this will never succeed. I understand how hard and jerks is..... I may move on myself. Lol
[LG V20 Guides, News, & Discussion] androiddiego:
Thanks Brian for your efforts on this!
[LG V20 Guides, News, & Discussion] Rukbat:
Just another 918 waiting for the opportunity to root this new phone (about 4 days old, so I can still return it for (ugh!) a Samsung if I have to). But I sure hope you can work the rooting out - if you do, I'll flash it.
[LG V20 Guides, News, & Discussion] Shirazak:
lol is anyone else checking this thread like 10 times an hours hahaha
[LG V20 Guides, News, & Discussion] aplusmiami:
About to switch back to my Note 4... Arrrrgh... Waiting patiently
[LG V20 Guides, News, & Discussion] lowtide100:
Me. I haven't visited any other threads.

Also, a big thanks to Brian for putting in the effort.
[LG V20 Guides, News, & Discussion] Shirazak:
Yes Brian is a hero to me right now haha ?
[LG V20 Guides, News, & Discussion] aquariuz23:
Keeping my fingers crossed too! Hopefully he makes a breakthrough soon :) No pressure Brian lol.
[LG V20 Guides, News, & Discussion] runningnak3d:
DirtyCow was patched, and ARB was incremented, so you can't roll back to a version that has a susceptible kernel.

This is an all new procedure that doesn't involve kernel exploits, but an exploit in download mode (laf) -- lafsploit.

Also, this is now confirmed to work on the H872 G6. It requires using the H918 laf, but unlike the H932 V30, it boots fine.

I still think that laf will boot on the H932, but to be safe, I need someone with a US998 unlocked so that they can use fastboot boot laf.img so no risk to their phone.

-- Brian
[LG V20 Guides, News, & Discussion] ybnrmalatall:
Right, explain that to the other guy.

I am asking if it's fine to update while I wait for this...
[LG V20 Guides, News, & Discussion] runningnak3d:
I know the LS997 guys want root, but instead of trying to get cross block device copying working safely, I am going to unlock your bootloader without the engineering aboot. That way, you can use the current method -- because once your bootloader is unlocked, you will be able to flash to laf.

-- Brian
[LG V20 Guides, News, & Discussion] ph4nt0m117:
I just need to be off my current image as fast as possible its driving me insane.
[LG V20 Guides, News, & Discussion] androiddiego:
Not after 10k. Maybe it was 10j. I'm still on 10j and it is rootable with dirtycow. Later updates are patched to stop the exploit. So if you are on H918 10p/q/s/t and want to root you need Brian's method. And you can't roll back from these versions for root. They are all ARB1 (Anti Roll Back 1).

10j(k?) and all previous are ARB0 which are rootable.
[LG V20 Guides, News, & Discussion] ph4nt0m117:
................... I meant with brians method lol. Thats the only one that is reliable at this point.
[LG V20 Guides, News, & Discussion] runningnak3d:
So, making some headway on cross block device flashing.

If you issue an OPEN with no payload, it opens the first block device /dev/block/sda in write protected mode. You have to use IOCT to enable read/write.

However, you can also pass a payload to OPEN which starts with the block device, and then a lot of bytes that I didn't understand. Well, it turns out these are flags. One of the flags enables read/write, so you don't need IOCT (but that isn't important for this). Another flag marks the device as the source or destination for COPY. So, now I just need to understand the flags a little better, but this is how I think it will go:

OPEN /dev/block/sda RO_FLAG,SRC_FLAG // let's say this returns FD 40

OPEN /dev/block/sde RW_FLAG,DST_FLAG // let's say this returns FD 41

COPY 41,src_offset,size,dst_offset // Notice the FD is of the block device that we want to write to. Normally COPY would take src_offset from /dev/block/sde since we are using FD 41, but since /dev/block/sda is flagged as the source, it should use FD 40 as the source.

Now, I may have this backwards, and you might have to supply the source FD to copy, and it will copy to the destination that is flagged.

This is going to be very risky to test because I will need to find space that I can copy from / to on both sda and sde that are in the exact same locations, and won't brick the phone in case it screws up and copies to the same block device.

For example, let's say that carrier is on sda, and it starts at LBA 1000 and ends at LBA 2000. LBA 1000 to 2000 would have to be unused or at least be a non-critical partition on sde as well because if I issue a COPY and let's say aboot was on LBA 1000 to 2000, and my first test was wrong and part of aboot got overwritten, I just bricked my phone.

Once cross block device copying is solved, the H918 won't have to flash laf first, can flash straight to recovery. I still recommend that everyone keep a copy of TWRP on both laf and recovery though.

-- Brian
[LG V20 Guides, News, & Discussion] Zacharee1:
We just need to figure out how to easily boot into LAF...

Android handles reboot reasons by putting `reboot,reason` as the value for `sys.powerctl` in the build.prop. Supposedly, the bootloader is supposed to pick that up and decide where to go from there. Do you think you could look at the bootloader, see if you can find where that's handled, and maybe see if there's a reason or something that can get us to LAF? I don't know how the bootloader works, or what it's written in, so I don't know if that's actually possible.
[LG V20 Guides, News, & Discussion] dudeawsome:
Use magisk to reboot
[LG V20 Guides, News, & Discussion] AliLaPointe:
Let me know if having info from a US Cellular V30 would help.
[LG V20 Guides, News, & Discussion] KanBorges:
Same!
[LG V20 Guides, News, & Discussion] yoez94:
help, lost the download mode and install another rom (lg_v20_h918_10p_debloated_v4_odexed) now the camera does not work.
[LG V20 Guides, News, & Discussion] Josh McGrath:
Find a flashable zip for your phone model and flash it using twrp
[LG V20 Guides, News, & Discussion] ph4nt0m117:
Install lineage OS.
[LG V20 Guides, News, & Discussion] yoez94:
I followed all the steps to root, I stayed in download mode then I restarted it, pressing the upload button I started in twrp and then I was curious flashee with superv20 v2.1. AND OTHER ROMS. without having a backup, normal start until obtube root, but it does not help me at all, and the camera does not work, the gyroscope sensor, my lg v20 was in 10s, I passed it to 10p to try root, and it ended eliminating the mode of descarga.estoy scared of not returning to stock since I flashed with many rom trying to find solution to the camera, PLEASE HELP AS I AM FROM PERU AND I DO NOT SPEAK ENGLISH. :( I'M JUST A HOBBY.
[LG V20 Guides, News, & Discussion] Josh McGrath:
Have you tried the flashable 100 percent stock zip for your phone model? Do a search on xda for it
[LG V20 Guides, News, & Discussion] yoez94:
323/5000

If I did the test with everything, use many roms but still not solved, the question I ask myself is if finding the UPDATE.ZIP where the laf is solucinar the way to download. give me some hope ... I SET GOOD AND NOT THE FLAHS WORKS THE LIGHT CENSOR THE CAMERA. I KNEW ALL DAY SEEKING THE SOLUTION AND NOTHING :(
[LG V20 Guides, News, & Discussion] ph4nt0m117:
My guy

https://wiki.lineageos.org/devices/h918

Seriously just flash something else
[LG V20 Guides, News, & Discussion] Josh McGrath:
What's the *exact* model number of your phone?
[LG V20 Guides, News, & Discussion] ph4nt0m117:
Going by the rom he got, I'd say he has an H918.
[LG V20 Guides, News, & Discussion] Josh McGrath:
That's what I assume too, but being from Peru, it may be different and shouldn't have tried this method at all.
[LG V20 Guides, News, & Discussion] yoez94:
I found in "UPDATE.ZIP" that they say it solves the download mode. how to proceed PLEASE HELP

https://drive.google.com/file/d/1IrVpn_PPQTuqFlWhkucx0-H6z5pJs7Bc/view?usp=sharing
[LG V20 Guides, News, & Discussion] yoez94:
Quizás quisiste decir: encontre la solucion y todos los que estan sin modo de descarga solo flasheen este ROM y eran que se restaura todo .DESPUES DE UN ARDUO TRABAJO. ESTOY CONTENTO SOY LG V20 H918 10S.

I found the solution and all those who are without download mode just flashed this ROM and they were restoring everything. AFTER A WORKING ARDUO. I AM CONTENT SOY LG V20 H918 10S.

https://drive.google.com/uc?id=1UQEp3Vxf9uRW_3c-SSSco3RndwQVLbFQ&export=download

ESTO ME AYUDO
[LG V20 Guides, News, & Discussion] Septembersrain:
I couldn't donate much but I really want to see the V30 H932 with root.
[LG V20 Guides, News, & Discussion] pbedard:
My next phone will be one with a remove battery
[LG V20 Guides, News, & Discussion] LOCO213:
i only get oem unlock check box in dev mode section no fastboot unlock am i missing something
[LG V20 Guides, News, & Discussion] ph4nt0m117:
Fastboot is being worked on.
[LG V20 Guides, News, & Discussion] Ken C:
I was reading that and not sure if he expected it to show up under developer settings once he hits that allow unlock button or not
[LG V20 Guides, News, & Discussion] juan_:
Then you (me either) don't have much choice:

- LG G5 and V20 disadvantages are 2016 and LG (no updates)

- Moto G5 is not enough "premium" (I want a great camera)

It's a bit sad because I dont like power socket slavery :)
[LG V20 Guides, News, & Discussion] ph4nt0m117:
anything new [MENTION=3167089]runningnak3d[/MENTION] ?
[LG V20 Guides, News, & Discussion] Josh McGrath:
He's on vacation right now
[LG V20 Guides, News, & Discussion] ph4nt0m117:
Is he off vacation yet
[LG V20 Guides, News, & Discussion] cnjax:
Nope, he took a permanent vacation. Ran off to a primitive deserted island, never to be heard from again ?
[LG V20 Guides, News, & Discussion] asdluisasd123:
sorry, my mistake
[LG V20 Guides, News, & Discussion] iodroid95:
So i have g

LG g6 h870s do i have a chance to get root ?
[LG V20 Guides, News, & Discussion] runningnak3d:
Just going to copy / paste this here for now:

Yep folks, that means that hacking the lafd protocol is no longer needed. Root for the LS997 coming ASAP!

This was one of those freak accidents. I was trying to do cross block device copying, and got full root access instead!

-- Brian
[LG V20 Guides, News, & Discussion] steadfasterX:
Exec 39... Lol :) why not 42...? :laugh:
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=5545101]steadfasterX[/MENTION] LMAO! Yea, 39 is the fd_num, so I guess I could have done a few more OPENs :P

There is more to it than just EXEC fd_num /full/path\0 but I will hold off the details till lafsploit 1.5 is released.

I will talk to you about it on IRC if you want the details ;)

-- Brian
[LG V20 Guides, News, & Discussion] steadfasterX:
Awesome really. Are you kidding??? for sure ;) unfortunately I'm online tomorrow first but I'm highly interested ;)
[LG V20 Guides, News, & Discussion] runningnak3d:
Let's throw some TWRP onto an H910. Now I can already root the H910 via other means, but I wanted to test this. If it works on the H910 -- and it does, then it will work on ANY model V20 on ANY ARB version:

# !EXEC 41 /system/bin/mount /dev/block/mmcblk0p1 /mnt\0
# ls /mnt
Android
DCIM
LOST.DIR
SWupdate

!EXEC 41 /system/bin/dd if=/mnt/SWupdate/recoverybak.misc of=/dev/block/sde bs=4096 skip=10246 count=6023\0
6023+0 records in
6023+0 records out
24670208 bytes (25 MB, 24 MiB) copied, 0.0505778 s, 488 MB/s

More to come ;)

-- Brian
[LG V20 Guides, News, & Discussion] runningnak3d:
So, where are those brave LS997 souls: https://xdaforums.com/v20/how-to/root-ls997-version-volunteer-t3781592

-- Brian
[LG V20 Guides, News, & Discussion] iodroid95:
I am a volunteer i have h870s
[LG V20 Guides, News, & Discussion] runningnak3d:
Sorry, an engineering aboot for the G6 hasn't leaked (that I know of).

Since I have a V20, and I promised all V20s would have root again, I am going to complete this first.

lafsploit 2.0 will unlock the bootloaders of LG phones (up to and including the G6 -- sorry V30 guys, your lafd is just too locked down for now) without an engineering aboot -- but that comes next.

-- Brian
[LG V20 Guides, News, & Discussion] iodroid95:
And if it get leaked will i be able to unlock the device and root it and build a custom rom

---------- Post added at 11:34 PM ---------- Previous post was at 11:31 PM ----------

I am very sorry for the noise and thank you for your efforts on rooting the v20 tho i dont have one

But can u explain what is aboot ?
[LG V20 Guides, News, & Discussion] runningnak3d:
aboot is what is usually called the bootloader.

When you unlock the bootloader, you are telling aboot to not check the integrity of laf, recovery or boot.

As I said, I have a way to unlock bootloaders, but I want to get it perfected on ALL LG devices before releasing it so that LG doesn't have as much time to patch it.

-- Brian
[LG V20 Guides, News, & Discussion] ChazzMatt:
I'll take that on my open market LG US998 V30+, thank you very much. Since LG won't give it to me like they were supposed to.

Sent via open market LG US998 V30/V30+

---------- Post added at 07:10 PM ---------- Previous post was at 07:07 PM ----------

So, is this outdated information now?

Because you seem to be hinting strongly in the V30 forum you have something cooking.

Sent via open market LG US998 V30/V30+
[LG V20 Guides, News, & Discussion] runningnak3d:
The info about the V30 became outdated about 15 minutes after I posted and decided to flash the G6 laf onto my phone and see if it would work on G6 laf ... it does. Not the method that got the results that I posted earlier, but a very similar method.

Since it works on the G6 laf, and the V30 laf has all the same opcodes, and the code paths haven't changed, it SHOULD work. Just need someone to test it.

-- Brian
[LG V20 Guides, News, & Discussion] iodroid95:
Will it unlock all lg g6 variants
[LG V20 Guides, News, & Discussion] ChazzMatt:
One step at a time. T-Mobile LG G6 already has bootloader unlock.

Sent via open market LG US998 V30/V30+
[LG V20 Guides, News, & Discussion] iodroid95:
I have h870s and it does not have unlock for the bootloader
[LG V20 Guides, News, & Discussion] Scott:
[MENTION=3167089]runningnak3d[/MENTION]

Brian, have you ever tried to unlock a Pixel 2XL (G011C)? Would you be willing to try? I am 100% willing to sacrifice devices as need :good:
[LG V20 Guides, News, & Discussion] ChazzMatt:
Then you don't have the T-Mobile LG G6, which has bootloader unlock. I said the T-Mobile LG G6, not some other G6 model number.

Brian says he will work on bootloader unlock next.

Sent via open market LG US998 V30/V30+
[LG V20 Guides, News, & Discussion] iodroid95:
Aaaooooooooooo. I did not pay attention to that :silly:

---------- Post added at 02:53 AM ---------- Previous post was at 02:53 AM ----------

Then i am out of luck
[LG V20 Guides, News, & Discussion] ChazzMatt:
Not necessarily. Brian says he will work on bootloader unlock next. That's why I said one step at a time. Do the T-Mobile LG G6 first, make sure it all works. Do the T-Mobile V30, which also has bootloader unlock. Then go from there.

Sent via open market LG US998 V30/V30+
[LG V20 Guides, News, & Discussion] runningnak3d:
Once I have completely conquered LG phones (I know the XL 2 is made by LG, but it doesn't have laf), I will move on to other vendors. :cool:

-- Brian
[LG V20 Guides, News, & Discussion] laneyyy:
Are you still suggesting that we don't update when Oreo comes out Brian? Or do you think you'll eventually be able to be unlock that too?
[LG V20 Guides, News, & Discussion] iodroid95:
I still dont understand
[LG V20 Guides, News, & Discussion] EstiR86:
Thanks for your work! Many on the Pixel 2 XL have been looking for a way to unlock! There is a pretty big bounty to collect too!
[LG V20 Guides, News, & Discussion] iodroid95:
And there is a 3000 usd bounty on unlocking h870s :eek:

---------- Post added at 04:50 AM ---------- Previous post was at 04:45 AM ----------

Lol i think i am takin it too serious
[LG V20 Guides, News, & Discussion] Scott:
I do believe it does have LAF. We were using the LAF tool to pull the partitions, write the partitions, look at device details, etc. The only thing it would not do is write of course. It was a download mode for sure and it seemed like all the other LG Download Modes I have seem.

However I will yield to your experience in the area of LG phones.

When you get time let us know. We would love to work with you on this!
[LG V20 Guides, News, & Discussion] cnjax:
Run Brian, they're coming out of the woodwork lol ?
[LG V20 Guides, News, & Discussion] runningnak3d:
If you were using lglaf, then this should work if you have an unlocked bootloader. If you don't then 2.0 will work for you.

Any device that has any version of laf up to Nougat, and an unlocked bootloader. It may work with Oreo laf, but I don't have a version that will boot on my phone yet, so I can't say for certain.

EDIT: [MENTION=426561]Scott[/MENTION] while waiting for some test subjects, I pulled down the Pixel 2 XL firmware and took a look. You definitely have laf, but it is unlike anything I have seen on normal LG devices. I will have to pull lafd out and fire it up with a kernel that will boot on my phone so I can see what the deal is.

-- Brian
[LG V20 Guides, News, & Discussion] ChazzMatt:
You're not out of luck. You just have to wait for the easier ones (T-Mobile) to get done first.

Then he can turn his attention to others.

Sent via open market LG US998 V30/V30+
[LG V20 Guides, News, & Discussion] iodroid95:
Ok i just need to wait

---------- Post added at 04:26 PM ---------- Previous post was at 04:26 PM ----------

By the way who is the developer ?
[LG V20 Guides, News, & Discussion] ChazzMatt:
Same guy who started this entire thread.

Sent via open market LG US998 V30/V30+