yashsingh1/xdaforums huggingface dataset:
[LG V20 Guides, News, & Discussion] runningnak3d:
So some insight from staring at decompiled lafd code.

It looks like IOCT specifies the source, and destination block device that is to be used for COPY.

So, on an eMMC device the IOCT opcodes will be the same since there is only one block device, but on UFS devices, misc is on /dev/block/sda and recovery is on /dev/block/sde.

So, if I am right, it will go something like this:

OPEN <sda>

OPEN <sde>

MISC WRTE

IOCT <fd_num of sda>,0x1261

COPY blah

IOCT <fd_num of sde>,0x1261

This forces the copy onto sde instead of sda

I am REAL lucky I didn't brick my phone. It just so happens what I was copying to where didn't impact anything important on sda.

More to come soon....

-- Brian
[LG V20 Guides, News, & Discussion] runningnak3d:
A dump of carrier:

49 74 20 57 4F 52 4B 45 44 21 0A It WORKED!

I have a few more things to work out, for example, I am still getting a LOT of timeouts on MISC WRTE and I am not sure why. I have asked for help from tuxuser who is a LOT more fluent in Python than I am. I wanted to port this to C++, but I just don't have the time for that.

As stated in the original post, I found someone else who had written some Python scripts to talk to lafd back in the G3, G4 days. I built on his work since that was easier than starting from scratch.

-- Brian
[LG V20 Guides, News, & Discussion] KanBorges:
My dude! :good:
[LG V20 Guides, News, & Discussion] ph4nt0m117:
So will we be able to do this on linux as well as windows? Will it just be a couple python scripts packed in with the eng aboot and some payloads? I'm getting anxious here man I feel like a meth head in prison.
[LG V20 Guides, News, & Discussion] Josh McGrath:
Python works on Linux as well .

[MENTION=3167089]runningnak3d[/MENTION]

If I run as a tester on the v30, all I have to do is drive to the TMobile store and get my replacement waiting on me. So a brick is no big deal for me if you want to test something or test write.

I only have a few days left before they send it back so it's a no loss on my end
[LG V20 Guides, News, & Discussion] TheDannemand:
I get the sense it would almost be wasteful NOT to brick it :laugh:
[LG V20 Guides, News, & Discussion] Josh McGrath:
That's the way I kinda feel ? the charging port is bad anyway so it's no loss to me
[LG V20 Guides, News, & Discussion] Nickvanexel:
Can anyone please tell me where I can get the latest lg up?
[LG V20 Guides, News, & Discussion] Eliminater74:
Dude I live down the street from you pretty much.. as it goes, St pete, largo, then Clearwater,, anyhow.................. you get all to work.. you give me motivation as to getting the new G7, and if what you say works

with that too.. I would be happy to buy you a few beers or whatever you need.
[LG V20 Guides, News, & Discussion] jcsww:
D: That G7 unibrow...
[LG V20 Guides, News, & Discussion] runningnak3d:
Alright, you guys that want to risk their phones to help out... here is you chance.

Download this: H830 KDZ.

It is a marshmallow KDZ for the G5. It should flash onto the V20 , G6 and V30 -- T-Mobile versions only for now!

Let me know the results.

Here are the possible outcomes:

1 - It doesn't flash

2 - It TRIES to flash, but you just end up with a blank partition, and you will never be able to flash your phone again.

3 - It flashes, but you end up with a bootloop, and you are never able to flash again, and you don't have a usable phone

4 - It flashes, and you have a working MM laf.

It is extremely high risk, but I can not get consistent results with Nougat lafd. It makes ZERO sense. If we can get MM laf onto our phones, then that is a game changer, since MM laf has been cracked.

However, I am not risking my phones anymore.

EDIT: I assumed it would be obvious, but just to be clear, you MUST use the patched LG UP, and ONLY flash the laf partition. If you flash anything else, you WILL brick your phone.

-- Brian
[LG V20 Guides, News, & Discussion] pro_granade:
So should not try this on the Sprint V20?
[LG V20 Guides, News, & Discussion] runningnak3d:
Absolutely not.

Only the T-Mobile versions can unlock their boot loader. When the boot loader is unlocked, it ignores verification of boot, recovery, and laf. So they are safe flashing anything onto those 3 partitions.

I want to see if THIS works, and then I can continue to come up with something that works for all the other model V20s with the engineering aboot. Without an engineering aboot / abl, root will never be possible for a model that isn't T-Mobile on the G5, G6, or V30.

-- Brian
[LG V20 Guides, News, & Discussion] draymond1987:
So let me ask you this: What is the possibility of it (the file in question) working?

What are the next steps IF the MM partition is on X phone. In my case, the V30.

IF a brick where to happen, what are the chances of Tmobile knowing I did something to cause it? I'm really good at making up fables, so I can say I installed some rogue app and my phone happened to be plugged into the PC. Once upon a time, I had a minor issue were I messed something up, where I could never update again (don't ask how), and I was like "I have no idea how my phone even got rooted! What the hell does that mean?"

BUT, I see a warning about the BL being unlocked, so I don't know if they can see that the flag was tripped?

I know it'll be IMPOSSIBLE if I hard bricked........ right?
[LG V20 Guides, News, & Discussion] TheDannemand:
As I read it, this is a highly experimental flash intended to verify ONLY whether that MM LAF will flash successfully on various models, ONLY for TMO models with unlocked bootloaders, and ONLY for people who are completely ready to brick their phones. Some members know they already have a warranty replacement waiting for them (@Josh McGrath), others are confident they will be able to get a replacement and/or are simply willing to take the risk.

Once you unlock the bootloader, you will be warned about loss of warranty, and you will get a big warning on every boot. And the Tamper flag will be set, even if you lock the bootloader again. So T-Mobile and LG can technically see what you did. The question is whether they will care, as many have found that they don't.

For my part I cannot risk my warranty (simply no money in this household for another phone). But I am tremendously grateful to those have the courage!

Of course I'll let [MENTION=3167089]runningnak3d[/MENTION] answer more definitively. And everybody should decide for themselves.
[LG V20 Guides, News, & Discussion] runningnak3d:
I thought I was pretty clear, but you laid it on the line pretty good.

It is a risk. A very HIGH risk. I have no idea what is going to happen.

I can tell you that the lafd certs match, so technically it is possible. However, I want to make it very clear that the potential for a brick is HIGH.

Ya know what, let's put it this way -- you WILL brick your phone, but I need the data.

-- Brian
[LG V20 Guides, News, & Discussion] draymond1987:
I know that another user DOES have a warranty device at the ready, BUT I'm all for trying to help a good cause. Would not be the first time that I bricked a phone, or phones LOL. I bricked the G4 twice and just played the "I updated the phone and it stopped working!" card. There actually was an update but I was trying to flash some ROM or something. Whatever it was, I know it had another variant's bootloader. It wouldn't boot at all, and at the time, there was no method to recover.

Anyhow, I guess I will read up on using the tool, and mentally prepare my body. I have another device to use, IF all goes south. Can't give an ETA because I am a procrastinator.

Gotta say though, you are doing amazing work!
[LG V20 Guides, News, & Discussion] Josh McGrath:
I'm with family for easter dinner, but as soon as I get a chance I will run this and get back to you asap.
[LG V20 Guides, News, & Discussion] draymond1987:
*raises hand* I needs a little help finding a patched LG UP for the V30. I tried the DIL file that was in the V20 thread, but I get an error pertaining to the "lg common dil" that was in the download. I actually had to download LG UP from LG's site.

Sorry, I am def being a noob. It's been awhile being on Android, so I'm rusty BUT not that intimidated to brick phones aha.

Thread in question: https://xdaforums.com/v20/how-to/guide-patch-lgup-to-unlock-features-t3652222

I googled LG UP patched and that was the first result, and I did check some others. Sorry guys.

Oh, Happy Easter to everybody!!

EDIT: Okay I got LG UP to work. I just am trying to figure out how to just flash that one file, and not the whole KDZ.

Also, I did find a KDZ for the H932, so IF a brick were to happen, would it be possible to recover, if the phone can somehow get back into download mode?

Yes, I'm nervous aha. If somebody else beats me to it, which may happen, I bow at your feet.
[LG V20 Guides, News, & Discussion] Josh McGrath:
If you downloaded the official LG version, you may not have the option to flash individual parts. You should have several options, instead of just 4.

Youll have to find the "store" version. It's easily found on here in autoprimes thread (can't search the link right now) then just swwap the dll s like you've already done and then select the partition only and choose laf and laf.bak .

[MENTION=3167089]runningnak3d[/MENTION], are we to flash the entire kdz or just the LAF?
[LG V20 Guides, News, & Discussion] draymond1987:
I actually got the patched version to work, but I am going to test with an LG V30 KDZ first, so I know what will happen. I do have the partition dil option, so I guess I just need to click "start" and the list will come up.

Only the LAF, from what I read...nothing else, or you'll brick it!
[LG V20 Guides, News, & Discussion] Josh McGrath:
I am not able to flash till later, but keep that v30 kdz in case it doesn't boot.

If it doesn't boot as in soft brick, you'll need to boot into download mode and flash it . In the past I had hell getting into dl mode and had to wait for the phone to die and then did the volume up and USB cord. Point I'm trying to make is, don't give up.

Also, don't do a factory reset, just reflash the v30 kdz. The factory reset made my situation much worse and harder to get into DL mode.

Just a friendly FYI :)

PS..of course the TMobile stores are closed today
[LG V20 Guides, News, & Discussion] draymond1987:
Well that was all for not.

LG UP keeps crashing when I run the "partition DL" . As I seen in that thread I linked, that was the way to get the list thingy up.

Maybe I need to start over and find the correct DIL?
[LG V20 Guides, News, & Discussion] MyNameIsCosmo:
Same issue here.

Did a system dump, and flashed the cache back with no success.

Currently running lgup through a debugger to see where it stops at.
[LG V20 Guides, News, & Discussion] draymond1987:
I keep reading that apparently there is not a patched V30 DIL? [MENTION=3250376]ChazzMatt[/MENTION] is this true? I don't know if I'm reading wrong or not, with this:

https://xdaforums.com/showpost.php?p=75244438&postcount=410

I used that LG UP with the common DIL, but it crashes when I try running the KDZ. I'm testing with the V30 one, first. I will feel more confident because I know I can't brick using the same partitions.
[LG V20 Guides, News, & Discussion] ChazzMatt:
See the attachments to this post:

https://xdaforums.com/showthread.php?p=75239518

Specifically the patched dll.

Sent via open market LG US998 V30/V30+
[LG V20 Guides, News, & Discussion] Josh McGrath:
EDIT: Beat me to it. Thanks [MENTION=4355498]chazm[/MENTION]att
[LG V20 Guides, News, & Discussion] draymond1987:
First DIL threw an error about it being wrong, and program didn't open.

Second DIL worked BUT I get a timeout error when I select Partition.

I'm sure I am doing something wrong, and I certainly apologize for it. If I use the Uppercut method, will I be able to just select the LAF partition to flash?

I'm getting ready to eat dinner in a little bit, so I will do more reading afterwards.
[LG V20 Guides, News, & Discussion] Zacharee1:
Just a quick note, that might help you later on, in research and such: It's DLL, not DIL. Stands for Dynamic Link Library.
[LG V20 Guides, News, & Discussion] draymond1987:
Yikes, I'm a dummy -_- Thank you for correcting me, so I don't embarrass myself further. I do like to learn new things and I really am thankful for the patience.

I think I should leave this to more skilled people because I can't even get the program to work. Probably an indication for me to back away and cheer everybody else on.
[LG V20 Guides, News, & Discussion] bigcletus:
You got this bro...flash away and let us know when you got MM laf working :)
[LG V20 Guides, News, & Discussion] draymond1987:
Soo uhhh, I'm a little nervous because I FINALLY got things to work out. Tmobile LAF was totally successful !

The adrenaline is real aha. I am mentally preparing myself. Also, what in the world will I be looking for IF it works out??
[LG V20 Guides, News, & Discussion] ClockworkImpulse:
I would guess that if his stuff works. Then you'll be able to boot and see something.

If it is booting. and not bootlooping or a brick, then its a working exploit!
[LG V20 Guides, News, & Discussion] draymond1987:
Error: 0x2000, "Unsecure flashing image" to "secure flashing device" error.

The GOOD news is that my phone is working. So the potential bad flash was blocked, which is nice! *PHEW*
[LG V20 Guides, News, & Discussion] Josh McGrath:
Edit... Checking to see if I have same result

---------- Post added at 01:31 AM ---------- Previous post was at 01:27 AM ----------

same error here. One thing that may be making it hard to flash is that the h830 kdz does not have a LAF.bak like the 932 kdz does
[LG V20 Guides, News, & Discussion] draymond1987:
I'd love to say some technical things, like I know what I'm doing LOL. I'm just a guy willing to brick a device, in hopes of getting root! I know this device probably has so much potential.
[LG V20 Guides, News, & Discussion] Josh McGrath:
Hey, we are all going for the same thing :) the more help the better!
[LG V20 Guides, News, & Discussion] Addiso:
Isn't that error related to the dll somehow? I recall back in a LG device (don't know which one) they had that type of error and a member made a custom dll to get it to flash. Could be wrong though.

Or what if maybe we pack a complete kdz with the modified LAF and try to flash?
[LG V20 Guides, News, & Discussion] draymond1987:
I'm going to assume it may not be the DLL, only because I can flash the Tmobile files. I'm sure I'd get the same error, I think?

It's just weird how it said it's an unsecure image and ours is a secure flashing device. Is there some other check that is happening when we flash files?
[LG V20 Guides, News, & Discussion] Addiso:
I was thinking more in terms off, we're flashing a laf that's not the h932 so I would assume maybe a different custom dll would need to be used to bypass the flash? We needed a custom dll to try and cross flash between v30s so I figured maybe the same method will apply here.
[LG V20 Guides, News, & Discussion] Josh McGrath:
The kdz is signed so packing twrp isn't an option. The g5, if I remember correctly, and hasn't been updated, does not require signed images to flash . That's how tungkick rooted the g5- with a modified tot.
[LG V20 Guides, News, & Discussion] draymond1987:
Ahh that would make more sense. I guess we have to wait to see if [MENTION=3167089]runningnak3d[/MENTION] has any more ideas?

Or figure out a way to modify it, like [MENTION=5070414]Josh McGrath[/MENTION] said.

There's certainly a way to do this, and I know we're close to figuring it out.

---------- Post added at 09:50 PM ---------- Previous post was at 08:54 PM ----------

Curiosity kills the cat.... So the MM LAF can be cracked, right? Would trying various other KDZ files be of ANY productive help?

Or did we find out, by trying to flash the listed KDZ, that it may not be possible because of the security thingy. I found a site with files for the H830, but I don't know if that particular KDZ was selected because it can be cracked, and no other MM's would be? I'm just thinking of things out loud.

https://lg-firmwares.com/lg-h830sv-firmwares/

Website for the curious.
[LG V20 Guides, News, & Discussion] Josh McGrath:
Can someone try this with uppercut? I don't think it will make a difference but I am having hell with it and my antivirus and needing LG 1.4

I'm trying to edit the 830kdz right now

---------- Post added at 03:09 AM ---------- Previous post was at 03:07 AM ----------

That's what I was thinking too. If I remember correctly when I had the g5, the 10i was the first attempt at security within kdz and tot files
[LG V20 Guides, News, & Discussion] draymond1987:
Going to bed because of early shift. But I hissed at the computer because Uppercut likes to break LG UP for me. I fixed it though, but it wipes out some files, and I get no common folder or something? I'm half asleep, but I fixed it aha.
[LG V20 Guides, News, & Discussion] Josh McGrath:
Can someone please boot into DL mode (no flashing needed) and tell me what it says under the model number on the bottom left of the box. This has to be an untouched device though, ie... no flashing at all done. Boot unlock is okay though
[LG V20 Guides, News, & Discussion] Addiso:
Unmolested device shows the following

H93210b

Official /E /L/ RO

Not sure if thats what you're asking for.
[LG V20 Guides, News, & Discussion] Josh McGrath:
I sent you a pm reply, but my PMs never work. Let me know if you didn't get it.

And yes, I thought I had something but apparently whatever you try to flash successful or not it shows it below the model number.

Also, I tweaked with the kdz via hex and after changing the model number, it won't flash "individual partitions" yet if I continue to change all the model names, it looks to flash but does nothing at all, not even a partition select.
[LG V20 Guides, News, & Discussion] Addiso:
Has anyone tried the fastboot flash laf command?
[LG V20 Guides, News, & Discussion] runningnak3d:
Don't waste your time trying to flash the H830 KDZ, it doesn't have a SIGN payload. I thought all KDZs had a SIGN payload, and LG only started to enforce using it with Nougat lafd. Nope. MM and earlier KDZs don't even have it.

-- Brian
[LG V20 Guides, News, & Discussion] TheLogicalGamer:
I'm pretty sure we don't have any fastboot commands other oem lock & oem unlock. Otherwise we could just fastboot flash recovery.
[LG V20 Guides, News, & Discussion] draymond1987:
So what needs to be done, good sir? I'm officially ready to flash anything, at this point. I get off work at 1pm EST.
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=5830858]draymond1987[/MENTION] You can try renaming it to .tot. I am not sure what will happen. I know back in the LP days, I had a .tot and whatever I was trying to flash it with didn't understand .tot, so I renamed it to .kdz and it flashed. Now that was a LONG time ago. Unfortunately, even with a pretty good understanding, I can't tell you what will happen -- but it is worth a shot.

I can flash to the carrier partition, or any partition on /dev/block/sda but recovery isn't on sda. So I am still fighting with how I was able to flash to sde.

-- Brian
[LG V20 Guides, News, & Discussion] johnmurrayvi:
Comparing the laf partition from the G4 to the V30, it looks like they obfuscated it quite a bit. It's a lot more difficult to fruitfully disassemble. I downloaded a V20 KDZ before I left so I'll try pulling the DLL out of there and taking a look.

***Edit*** Whoops, meant the LAF partition from the V20 KDZ. I was going to get an older DLL from a KDZ for the G4 or maybe the G3 to check if there's anything useful related to IOCT.

If IOCT works like POSIX ioctl (which it probably does I'd guess), the second argument would be an encoded request (ioctl man page).

I've got a couple of meetings and things today but I'll get back to digging around some more later tonight and try to get my IRC client back up and running.
[LG V20 Guides, News, & Discussion] draymond1987:
So I changed the file name (KDZ to TOT).

Well, it flashed everything fast, without giving me a chance to even pick a partition. The good news is, my phone booted back up.

No errors or anything. Like I said, it flashed in seconds, so I don't know what happened aha.

Edit: I flashed it twice more because I wanted to see if it said anything DURING the flash. It just says finalizing. It does not reboot on it's own. Gotta manually do that, but it boots back up.

---------- Post added at 01:37 PM ---------- Previous post was at 01:30 PM ----------

I was looking for the LAF fastboot command and I came across this. I wonder if this is of any help??

https://xdaforums.com/showthread.php?t=2708466

I'm sure it's a bad idea LOL
[LG V20 Guides, News, & Discussion] Eliminater74:
That post was for the G2 and G3, and it worked, cause neither had access to fastboot, removing the laf partition allowed access to fastboot, but when LG froze all the fastboot commands

that didnt allow anymore access regardless if you dropped down to fastboot when they updated firmware..

But g4 and up, that wont work.. and LG patched that hole some years back anyhow..
[LG V20 Guides, News, & Discussion] pyrorob:
I had an idea, awhile ago I pulled my update.zip from cache to look through, noticed it had a similar layout to a twrp zip, had all the boot files in it, laf, boot, recovery, etc, do you think going over the flashing commands in its updater script might give you an idea? I'm thinking if you could place your own update zip in cache or any of the other locations you could basically trick the stock recovery into flashing laf, or hell even recovery?

I could post it's updater script file if youd like (it's from h918 10r) or the whole update zip if you want..
[LG V20 Guides, News, & Discussion] runningnak3d:
update.zip (or dlpkgfile) is signed (search for APK signing).

-- Brian
[LG V20 Guides, News, & Discussion] draymond1987:
[MENTION=3167089]runningnak3d[/MENTION] I guess I am not reading far enough back, but it IS possible to flash TWRP ? I know you said you did it by accident, I think.

I know I was silly to try, but naturally I got a failed flash when I tried a US open market TWRP. Guess I thought my earlier flash of the TOT might have done something.
[LG V20 Guides, News, & Discussion] Josh McGrath:
It would fail even with the correct version of twrp ?. You're learning though, that's always good to see

[MENTION=3167089]runningnak3d[/MENTION]. I think you should take a couple of days off to relax and let us buy you some beers for your hard work this far.
[LG V20 Guides, News, & Discussion] Gamesoul Master:
What you flashed was a test to see if it could be flashed successfully at all. An entry-point for further research, from what I gathered.

I'm eagerly awaiting his response as to whether your flash was successful or did nothing at all. No idea myself of course, just one of the many people eagerly watching the progress, wishing I could help in some way, since I have a V30 and it seems better people than I are already covering that front.
[LG V20 Guides, News, & Discussion] draymond1987:
I'm certainly trying, and willing to be a "tester", if [MENTION=3167089]runningnak3d[/MENTION] wants.

I agree! I'll throw in some money. Do get some rest, as well. You deserve it.

---------- Post added at 05:34 PM ---------- Previous post was at 05:23 PM ----------

I'm curious to know if anything changed on my device too. I wish there was a way that I could check myself, without being a bother. I mean, I do not know if ANYTHING happened, since the TOT flashed without giving me any options. I am curious if I just picked "refurb" or "upgrade" if it'll do the same thing. I only say that because I changed the extension, which probably created a placebo effect?
[LG V20 Guides, News, & Discussion] Josh McGrath:
Even though I pretty much knew it didn't do any changes, the way i confirmed is by trying to flash twrp through lgup and got errors. But now we know that it was futile as runningnak3d stated.
[LG V20 Guides, News, & Discussion] draymond1987:
And I tried a similar way via fastboot, but it failed like Josh said. I'm peeking around different forums for ideas.