yashsingh1/xdaforums huggingface dataset:
[LG V20 Guides, News, & Discussion] runningnak3d:
For posterity's sake, I am going to leave this here as well:

And just for giggles while I was waiting, I took the V30 lafd and installed it into a boot image that will work on my phone:

dd if=/dev/zero of=/dev/block/sde bs=4096 skip=10246 count=6023
dd if=/dev/block/sde of=/cache/recovery_zeroed.img bs=4096 skip=10246 count=6023
strings /cache/recovery_zeroed.img
## No output - recovery is zeroed ##
dd if=/mnt/h918-twrp.img of=/dev/block/sde bs=4096 skip=10246 count=6023
dd if=/dev/block/sde of=/cache/twrp_test.img bs=4096 skip=10246 count=6023
head -5 /cache/twrp_test.img | strings
==> /cache/twrp_test.img <==
ANDROID!v<��wi ����console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 user_debug=31 ehci-hcd.park=3 lpm_levels.sleep_disabled=1 cma=32M@0-0xffffffff androidboot.hardware=elsa androidboot.bootdevice=624000.ufshc [B][U]androidboot.selinux=permissive[/U][/B]
<snip>

This proves that the V30 lafd can write to /dev/block/sde which is where recovery is located. So, I just rooted a V30 because running V30 lafd on a V20 makes no difference. The lafd binary is what matters...

Now I need someone with an ACTUAL V30 to do this ;)

-- Brian
[LG V20 Guides, News, & Discussion] cnjax:
Grab those bountys before someone else steals your methods and claims them
[LG V20 Guides, News, & Discussion] runningnak3d:
None of the info that I have posted would do anyone any good. Getting a root shell inside laf is the actual exploit -- those are just normal Linux commands that can be run once you have a root shell.

EDIT: Oh, and just so everyone knows that this is a lafd with no COPY opcode:

[LAF] can't found command list cmd = 0x59504f43
[LAF] failed validate check laf message : 0x8000001

[LAF] laf_message.command = 0x59504f43(COPY)
[LAF] laf_message.arg0 = 0x0
[LAF] laf_message.arg1 = 0x0
[LAF] laf_message.arg_opt0 = 0x0
[LAF] laf_message.arg_opt1 = 0x0
[LAF] laf_message.data_length = 0x0
[LAF] laf_message.data_check = 0x5ed6
[LAF] laf_message.magic = 0xa6afb0bc

-- Brian
[LG V20 Guides, News, & Discussion] iodroid95:
Are u that lit developer who root phone my boi
[LG V20 Guides, News, & Discussion] Masta Of Evil:
I have a T-Mobile V30 and am at your disposal for next 4 hours.
[LG V20 Guides, News, & Discussion] runningnak3d:
Here is the list of requirements: https://xdaforums.com/lg-v30/how-to/root-h932-lafsploit-1-5-volunteer-t3781839

If you are good with those, let me know.

-- Brian
[LG V20 Guides, News, & Discussion] runningnak3d:
So learned something today. There is a QFPROM fuse that controls lafd security. The LS997 and H932 have it blown (and the LS777 -- was trying to help someone with an LG Stylo 3).

It appears that if this "secure laf" fuse is blown, then execvp can not be overridden with the backdoor, so you are limited to the list of commands that are hardcoded in lafd.

So, even if we booted a laf from another phone / model on a model that has that fuse blown, it doesn't matter. For example, I can run the LS997 laf image directly UNMODIFIED on my H918 and it works fine. I can open up the H918 laf image and replace lafd with the H932 lafd (can't boot the image directly due to the kernel), and it works fine. So the limitation isn't in the lafd binary, but on the phone that it is flashed on.

Good one LG. I am guessing this a security feature that they offer carriers that most chose to forego on the V20. It looks like only Sprint decided to so far.

Well, even in failure, learned something....

Back to the drawing board for root on the LS997 and H932 :(

-- Brian
[LG V20 Guides, News, & Discussion] keaheng:
Now its time to break the pixel 2 xl wall my friend ;)
[LG V20 Guides, News, & Discussion] Scott:
Thanks for looking. I agree the LAF sounds a little different than what is described by some other items I have read. But yes, the LGLAF tool worked in reading and getting info, just not writing. Our bootloaders are locked so we cant go that route.

If you need me to try anything please PM me!

EDIT: ALSO: Please feel free to post in our root thread for the P2XL! https://xdaforums.com/pixel-2-xl/how-to/temp-root-bounty-verizon-users-t3710652.

There is a substantial bounty that can be claimed if you can get this rooted.
[LG V20 Guides, News, & Discussion] BROKEN1981:
In case you haven't noticed, this thread is not for the Pixel. If you wanted root so badly, you would not have bought a pixel from Verizon.
[LG V20 Guides, News, & Discussion] ChazzMatt:
Right. Plenty of non-Verizon Pixels can be rooted. And they will still work on Verizon.

Sent via open market LG US998 V30/V30+
[LG V20 Guides, News, & Discussion] runningnak3d:
Actually this is for LAF which all LG phones have. I am going to look for the proper forum to have it moved to because it really doesn't belong in the V20 forums since it is not V20 specific.

Also, please try to be nicer to someone that has obviously done a lot of development work for various phones.

-- Brian
[LG V20 Guides, News, & Discussion] BROKEN1981:
Yeah, sorry about that. Happens when you have a moronic nephew who decides to get into a phone. I have him working with me and he grabbed my phone. I also have to explain a few text messages to my mother because of him.

I would have deleted the post, but I would have much rather explained the post.

Again, sorry guys.
[LG V20 Guides, News, & Discussion] ChazzMatt:
If you're referring to my post, I'm more speaking generally about people who buy stuff like Verizon Pixel phones then complain they're locked down when they could buy Pixel phones that are not locked down.

You personally get all the respect for helping with dev work, as do other devs.

I bought an open market LG US998 V30+ that SHOULD be bootloader unlocked and rooted but isn't, due to LG not following through.

Sent via open market LG US998 V30/V30+
[LG V20 Guides, News, & Discussion] Scott:
NVM, mis-read.
[LG V20 Guides, News, & Discussion] iodroid95:
What do u mean
[LG V20 Guides, News, & Discussion] ChazzMatt:
Let's drop it. He says he didn't write it. That's what he means.

Sent via open market LG US998 V30/V30+
[LG V20 Guides, News, & Discussion] iodroid95:
I was wondering is modifying 32bit device kernel easier than 64bit devices
[LG V20 Guides, News, & Discussion] xXCoolGuYXx:
Hello I just want to thank you all for working to get the root on the LG V20 q update, I was wondering have we got any where closer to a root or did people stop working on it because I haven't heard anything come from this threath in a long time .
[LG V20 Guides, News, & Discussion] cnjax:
Depends on your phone variant. If h918 look at the laf exploit thread.
[LG V20 Guides, News, & Discussion] xXCoolGuYXx:
I have the h918 and thanks I'll have a look right now.
[LG V20 Guides, News, & Discussion] iodroid95:
Did u see that ? Lg is rolling android 8 out to lg g6 ,lg g5 and lg v20 the next Monday
[LG V20 Guides, News, & Discussion] KanBorges:
does anyone think that they monitor threads here? ?
[LG V20 Guides, News, & Discussion] iodroid95:
It is a praaaaannnnnnnkkkkkkkk. Pra
[LG V20 Guides, News, & Discussion] madhavajay:
So this doesn't work for non Unlocked Bootloaders?

Is anyone interested in helping search for a vulnerability for the non unlocked bootloaders of LG G6 etc using this:

https://www.kitploit.com/2017/12/bo...m_campaign=Feed:+PentestTools+(PenTest+Tools)

Im a n00b but have hardware that im happy to help testing with etc.
[LG V20 Guides, News, & Discussion] Scott:
No, see here: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2729 and a list of affected devices here: https://www.securityfocus.com/bid/96526
[LG V20 Guides, News, & Discussion] iodroid95:
Waw what an interesting website u got overthere
[LG V20 Guides, News, & Discussion] cnjax:
Why are you posting about a G6 in a v20 thread
[LG V20 Guides, News, & Discussion] TheDannemand:
The OP actually clarified just a few days ago that this thread (and the LAFsploit approach) is for all LG phones.
[LG V20 Guides, News, & Discussion] Josh McGrath:
Before we cause a jihad of people in here, it's not for *all* LG such as the h932 -AT PRESENT-
[LG V20 Guides, News, & Discussion] TheDannemand:
I know what you mean.

Actually, I think Brian's point was that this is a thread for LAF exploit development, not for any specific phone. And the fact that it's a Development thread *should* in principle keep it focused on technical contributions and discussion and prevent it from being overrun by wild hordes.

Edit: Ahem... and of course I should let him answer all this. I didn't mean to put words in anybody's mouth, merely to refer to the post he made a few days ago.
[LG V20 Guides, News, & Discussion] runningnak3d:
You worded it very eloquently.

If you, or anyone else has a suggestion for a forum to move the post to, I am all ears.

-- Brian
[LG V20 Guides, News, & Discussion] TheDannemand:
Obviously a general LG subforum would be ideal, but there is no such subforum. Maybe [MENTION=7055541]Zacharee1[/MENTION] has some suggestions here.

You could also leave it here in the V20 forum, since many already know its location, and many links have been posted to it. Then use the Opening Post to actively manage it by very clearly stating what kind of discussion you want in the thread, AND keep it updated to list devices covered so far (with links to their individual root threads), AND updated to state which devices are currently the main focus of your work. Pointer threads could be created in new relevant device subforums with links back here. Such pointer threads could even be locked to make sure any discussion is driven back here and save you from having to watch a dozen threads.

As for how to prevent Dev threads from being flooded, I don't have any suggestions other than being very clear in the Opening Post. The problem is of course that many people never read Opening Posts :o
[LG V20 Guides, News, & Discussion] Zacharee1:
A possible section would be https://xdaforums.com/android/software-hacking. Just make it clear that this is for LG devices only.

If you've applied for RD and haven't gotten a response yet, wait. If you get RD, you'll be able to create a locked thread where only you can post updates. You can then make a discussion thread in General.
[LG V20 Guides, News, & Discussion] cloud1250000:
When are you on irc? [MENTION=3167089]runningnak3d[/MENTION]
[LG V20 Guides, News, & Discussion] PhillyWonka:
So can't get my Ubuntu to recognize the phone. I'm using 2.0 usb. I know my lg drive is update because i had to roll back to 10p. Any suggestion. I'm stuck at the first commmand .pip3 install cryptography
[LG V20 Guides, News, & Discussion] Masta Of Evil:
What error does it give you when you type that command?
[LG V20 Guides, News, & Discussion] PhillyWonka:
The device isn't recongnized

I can't get Ubuntu in Windows 10 to recognize my device when phone in download mode
[LG V20 Guides, News, & Discussion] Masta Of Evil:
That's something people are trying to get, USB devices aren't recognized in Ubuntu for Windows, it's a Microsoft thing. Just boot ubuntu or FWUL from a USB drive.
[LG V20 Guides, News, & Discussion] Phoenix591:
Thats why the guide says

To avoid random complications. Just use the FWUL image provided and do it (more) safely.
[LG V20 Guides, News, & Discussion] PhillyWonka:
Thanks for the advice

How big does the flash drive need to be?
[LG V20 Guides, News, & Discussion] mikelimtw:
I've been reading this thread with much interest. I just recently acquired a 64GB Verizon LG V20 in China of all places. The phone was missing the box and accessories, but looked brand new and unused. This is my first LG device as I have in the past used only Samsung Android phones (Note3/Note4). Anyway, props to [MENTION=3167089]runningnak3d[/MENTION] for the great work he's done here. I'm definitely looking forward to root my V20 when lafsploit 2.0 is ready for the masses.
[LG V20 Guides, News, & Discussion] Phoenix591:
The verizon variant can do the well proven dirty santa method, lafsploit is focused on the h918 (and the author is working on applying it to the ls997) since those two can no longer use dirty santa . The dirtysanta method is laid out in the vs995 all in one thread.
[LG V20 Guides, News, & Discussion] mattnin:
But the OP is working on automatic methods to root the phone which is much better than dirtysanta unsupported thread or the badly written all in one thread. I'm also waiting patiently for lafsploit for VS995.
[LG V20 Guides, News, & Discussion] ph4nt0m117:
LS997 status yet? The stock rom is literally deleting contacts.
[LG V20 Guides, News, & Discussion] mikelimtw:
Yeah, I know about the Dirty Santa method. I've read up on it also and it looks a bit risky. I'm an old hand with rooting Samsung phones but this is my first LG and of course, everything is different. I'm a patient guy, I think I can wait for the lafsploit and a more reliable root solution. Anyway, thanks for the link.
[LG V20 Guides, News, & Discussion] cnjax:
That's incorrect, the OP isn't working on an automated or one click root method. He's working on a more streamlined process.

---------- Post added at 01:58 PM ---------- Previous post was at 01:52 PM ----------

If you think the dirty santa is risky or difficult then you should probably avoid the laf exploit
[LG V20 Guides, News, & Discussion] mattnin:
I'm with you. Rooting it using Dirtysanta looks like a mess, especially seeing that the head dev fled the thread and now users are left to people like [MENTION=4201835]cnjax[/MENTION] to help them out. No thanks. An easier and more automatic method like what the OP is working on is just what the LGV20 community needs to get more people involved. It's not the first time that some talented developer came in and published a better root method and everyone began using that vs past root methods.
[LG V20 Guides, News, & Discussion] cnjax:
Dirty Santa is much easier than the laf exploit method, you just need adb on a pc and the required files provided in the thread. The Laf exploit method is much more involved, requires the user to have Linux knowledge, Linux tools, a hail mary, a hop skip and jump to get it running on your pc lol
[LG V20 Guides, News, & Discussion] BROKEN1981:
Dirty Santa is actually easier. Not sure what makes you think otherwise.

I'll take adb over fulw or Linux any day.
[LG V20 Guides, News, & Discussion] christopherrrg:
[MENTION=3167089]runningnak3d[/MENTION] will this eventually be feasible for the Canadian H873? I tag because I wanted to ask if the eng aboot you acquired included us. I know officially our bootloaders cannot be unlocked (yet nor do LG show any interest in doing so) but we are able to use fastboot as far as the unlock ID (not sure if that matters) I haven't noticed any devs at all with a Canadian edition and if we are SOL I thought I'd ask the source. :) great job with root by the way, I hope everyone adheres to their pledges as you very much deserve it.
[LG V20 Guides, News, & Discussion] cnjax:
The eng bootloader came from a leaked debug phone v20 so no it will not work for other models
[LG V20 Guides, News, & Discussion] christopherrrg:
I appreciate the swift response thank you.
[LG V20 Guides, News, & Discussion] ph4nt0m117:
Still anxiously waiting for the root. I hope I can do it soon on my LS997. The rom bugs are getting worse. I know can't use wifi, and I haven't done anything to even hurt the phone. Its like the rom is degrading.
[LG V20 Guides, News, & Discussion] jcpowell:
LS997 is a huge PITA, let's just call it what it is FUBAR and move on, lol

Now I'm just hoping we get Oreo so I can update this POS
[LG V20 Guides, News, & Discussion] ph4nt0m117:
RN said he nearly had it though.
[LG V20 Guides, News, & Discussion] BulleT0o:
Wanting to root my H870ds
[LG V20 Guides, News, & Discussion] cnjax:
Do it To it
[LG V20 Guides, News, & Discussion] iodroid95:
How it's hanging boi ?
[LG V20 Guides, News, & Discussion] ph4nt0m117:
Updates for LS997 yet?
[LG V20 Guides, News, & Discussion] runningnak3d:
The LS997 has more security than any other V20.

Without having access to one, I can not go any further. Trying to talk people through tests via IRC just doesn't work, and while they are dirt cheap now, I am not going to buy an LS997 just to root it :)

-- Brian
[LG V20 Guides, News, & Discussion] laneyyy:
Does that mean that you're just going to stick with root for the h918 now, or are you still working on other v20s?
[LG V20 Guides, News, & Discussion] runningnak3d:
What other V20 can't currently be rooted?

As far as I know, every model except the LS997 can be rooted -- even on the latest firmware .. well, you have to roll back, or flash another model, but they are all rootable.

-- Brian
[LG V20 Guides, News, & Discussion] runningnak3d:
Hmm. Actually, I just thought of something. I have been trying to get around dm-verity. Instead of getting around it, we make a special build of TWRP that has dm-verity enabled. When your bootloader is locked, aboot will only boot a kernel that has dm-verity enabled.

So, since the LS997 can flash an older laf version (ARB isn't checked on laf), we can get the COPY opcode. Then we flash the special TWRP build that will boot even with a locked bootloader.

Once TWRP is on the phone, we can flash the engineering aboot that will unlock the bootloader. From there you can root just like any other V20.

-- Brian
[LG V20 Guides, News, & Discussion] christopherrrg:
Edit - sorry needed coffee before I opened this thread, my mistake!

Had asked if this applied for the H873 (Canadian G6 but as Brian stated it should apply to most G6)
[LG V20 Guides, News, & Discussion] runningnak3d:
You shouldn't have edited your post -- remember, this thread is for LAF, so that applies to ANY LG phone.

I have ordered an H931 (AT&T V30). Over in the V30 forum, some dude accidentally unlocked his bootloader by cross flashing other variants - talk about awesome luck.

Now that I know for certain that it can be done, I am going to make it safe (heck that method MAY work for the LS997 as well).

Anyway, that work will apply to the G6 as well.

-- Brian
[LG V20 Guides, News, & Discussion] christopherrrg:
Dang that definitely is some great luck, you're right I just didn't want to come off as pushy or asking eta etc. Since I got wind of your working on LAF it's gotten me lurking into several LG threads lately. Came from nexus and samsung devices so when I orginally got my G6 I assumed it would work like the nexus line, glad to see someone out there can finally make some sense of all of this. Good luck and thanks again for your insight!
[LG V20 Guides, News, & Discussion] iodroid95:
Finally ! My Patience is paying off after i read this
[LG V20 Guides, News, & Discussion] runningnak3d:
Has the US997 gotten Oreo yet?

-- Brian
[LG V20 Guides, News, & Discussion] christopherrrg:
No sir, awaiting that kdz like the holy grail. lol
[LG V20 Guides, News, & Discussion] runningnak3d:
Keeeeeeep on waiting. Between the lafsploit, and now the major V30 abl bug, LG may never release Oreo for the the V20, and G6.

*Sigh*

The good news is that LS998 are going for 250 buxx. Get one while you can and sell your V20 or G6 on eBay.

-- Brian
[LG V20 Guides, News, & Discussion] christopherrrg:
That's why I find it awfully weird that us canadian guys would get oreo early before unlocked variants. I bet it's carrier the reason why but still extremely fishy that the locked down variants would recieve the next revision of android before the unlocked :silly:
[LG V20 Guides, News, & Discussion] iodroid95:
Lol
[LG V20 Guides, News, & Discussion] christopherrrg:
Is LAFsploit still viable for other devices? Still very much looking forward to your write up :)
[LG V20 Guides, News, & Discussion] runningnak3d:
I am not releasing anything else until we get Oreo.

-- Brian
[LG V20 Guides, News, & Discussion] Zacharee1:
So that means this project is abandoned? :p
[LG V20 Guides, News, & Discussion] cnjax:
Lmao
[LG V20 Guides, News, & Discussion] runningnak3d:
LOL! I guess I should rephrase that to: I am not releasing anything else until we get Oreo, or 2020 .. whichever comes first :p

-- Brian
[LG V20 Guides, News, & Discussion] christopherrrg:
We got Europe** today.

He got it from LG Bridge.

https://xdaforums.com/lg-g6/how-to/kdz-v20a-europe-h870-t3794342
[LG V20 Guides, News, & Discussion] ph4nt0m117:
Man, I thought you had it in the bag. What happened?
[LG V20 Guides, News, & Discussion] Zacharee1:
He's not releasing it until Oreo comes out so LG doesn't have time to make a last-minute patch.
[LG V20 Guides, News, & Discussion] ph4nt0m117:
Wait, so oreo is confirmed?
[LG V20 Guides, News, & Discussion] cnjax:
Last I read its been pushed back to August. But the carriers need time to bloat it up so with any luck maybe before the end of the year
[LG V20 Guides, News, & Discussion] christopherrrg:
I understand now after reading more of the frankenstein thread. You mean US997 oreo. My apologies! Looking forward to what you've got for all of us. Thanks.
[LG V20 Guides, News, & Discussion] iodroid95:
If you have sense of humor :silly:you will understand the joke below

Lg
[LG V20 Guides, News, & Discussion] iodroid95:
Me : grab popcorn /set on my comfortable sofa / open xda app and watch the development as it goes slower than a turtle and cheer !

Dev : shut the hell up

Seriously, i hope LG can just listen to the customer who spent money on their products and unlock the bootloader

---------- Post added at 06:59 AM ---------- Previous post was at 06:56 AM ----------

At least they can release oreo so that everyone can theme their devices with substratum (no root)
[LG V20 Guides, News, & Discussion] cnjax:
This is off topic for this thread
[LG V20 Guides, News, & Discussion] iodroid95:
I was just sayin
[LG V20 Guides, News, & Discussion] xXCoolGuYXx:
How would one get download mod back on laf ?
[LG V20 Guides, News, & Discussion] iodroid95:
Still under development i think !

---------- Post added at 10:53 PM ---------- Previous post was at 10:52 PM ----------

The dev wants to release a stable software if your new here
[LG V20 Guides, News, & Discussion] ph4nt0m117:
Uhhhhh

So my phone grabbed an update that is suspiciously Android ROM sized (115.14MB). It seems to keep starting the install process and I cancel it before it can do anything.

Do I let it do it? (LS997)
[LG V20 Guides, News, & Discussion] jcsww:
If you want to. Otherwise, usually clearing the cache should stop that until it tries to install again.
[LG V20 Guides, News, & Discussion] christopherrrg:
Is your tool here : https://gitlab.com/runningnak3d/lglaf

Safe for prodding the G6 assuming I don't touch wrte partitions?

Just wanted to ask because I was trying SALT but unsure if I'm getting the correct information.

EDIT : figured it out thanks
[LG V20 Guides, News, & Discussion] iodroid95:
Are lg partitions the same as the other phones ?
[LG V20 Guides, News, & Discussion] Josh McGrath:
I asked the same question and I found out that every phone model is different, even from the same manufacturer.
[LG V20 Guides, News, & Discussion] christopherrrg:
I believe they may differ. I've only got the H873.

LAF is open source so if you know how to set it up, try and figure out your partition list.

(I've got FWUL set up, just haven't had time to sit down yet as I'm working two jobs.)

https://gitlab.com/runningnak3d/lglaf/blob/master/README.md

[Sorry for spamming your gitlab link too runningnak3d, figured yours would be best as you've done the H872]