[LG V20 Guides, News, & Discussion] partcyborg:
Hi! Was recommended this post by someone on TG. I have played with a lot of this stuff in Samsung land, mostly on the sd835, and I have some answers to some of your questions I think.

Caveat that these apply to sd835 and (mostly) sd845, so things COULD be a little different on older chipsets, but I think I know at least where. I'll try to make note where in aware and where I'm not

at least on sd835 there are several different arb numbers, maybe even up to one per partition is possible. The one that gets labeled in the releases is usually either boot/recovery or xbl/abl. sd835 has one for modern and one for non_hlos at least too. This is why sometimes your can flash partial firmware a version back.

Sec is a really interesting one. This partition actually is used by the oem to do the initial qfuse blowing! A special sort of config file gets created by internal tools (of which I happen to have a fully functioning copy of ?) which the oem writes to this partition which does the initial rpmb init /qfuse setup that does things like enable secure boot. Unfortunately, the first thing I tried was pushing one to my device with secure boot off, but it ignored it. Most likely because enabling secure boot is not reversable since it's in a qfuse, and I've also heard rumors that a special keymaster is needed to actually do that programming, which I don't have access to.

What could be useful here though is there is additional key spaces for what keys are used to validate firmware, and some switch to look for keys in qfuse or some kind of debug location, but I could never get this to work either. I wasn't exhaustive here though as nothing ever seemed to remotely acknowledge I had changed sec, no errors even if I wrote /dev/random or /dev/zero to it, so I figure I'm missing a necessary piece.

The boot-from-sdcard thing is called Tflash, and at least on samsung devices it is disabled in all signed bootloaders after some fairly embarrassing vulnerabilities allowed for complete secure boot bypass a while ago. If LG leaves this on, definitely look closer as simple mistakes were made like not bounds checking boot images letting you overwrite about memory (lol).

This all holds true with sd835 too, although aboot is now called abl and is now an efi firmware packed in an elf file. For sd835 and sd845 I recently discovered how to take this pack apart and was able to pull out the 2 individual binaries inside (aboot and for Sammy Odin which is kinda like out laf). If this interests you install binwalk under linux (or find a Windows version I'm sure there is one) and take a look.

This is SUPER interesting, great find! I discovered actually most of the resistance levels it looks for are actually documented at some point early boot in the kernel logs, so if you can get a dmesg output that goes all the way to the start of kmsg you will see a block about resistance levels. I actually bought a adjustable resistor to wire into a usb cable, but I haven't had a chance to figure out how to wire it in yet to play around. Saving for a rainy day ?

Nope! Firehose checks nothing whatsoever. You can write anything you want to any part of the flash using the firehose, only the xmls tell it what to put where. This could be used as a way to get root if all else fails, but it's way too dangerous for Mass consumption. We have had people actually literally perm brick, as in USB port is dead to the world, trying to do too much with the firehose.

While firehose doesn't check anything, the pbl does check firehose. The firehose binary must have a matching arb to I think the xbl's arb for it to be accepted as a programmer. This means with every bl increment you need a new firehose binary. We have decent luck finding them online for usually one or 2 versions back from current, and who keeps their ARBs current anyway? ?

I would love to talk to you more about this sometime, as this is news to me and my wheels are already turning with ideas if it pans out. Are you on telegram?

Yah, it's in the PIT file which gets written to qfprom and to ufs actually. It's signed and validated by secure boot though.

Hope some of this was helpful! Feel free to ask any followups or find me on telegram if you wanna chat some more