yashsingh1/xdaforums huggingface dataset:
[LG V20 Guides, News, & Discussion] lamepsycho:
I'm on 10e, is there any way to bypass ARB and flash oreo via twrp and revert back in case Oreo doesn't work as desired?
[LG V20 Guides, News, & Discussion] cnjax:
To go to oreo arb is going to be incremented, I'd update to 10p first take a back up then proceed to update to oreo
[LG V20 Guides, News, & Discussion] the_R00ter:
hey, I have a v20 running android oreo and the software version is h91020h. the battery life is a piece of garbage, replaced the battery, and it still is. Is there an active root out their that i could flash and somehow unlock the bootloader too? If i could, my guess is that the battery life would become better. I can handle the ROM.
[LG V20 Guides, News, & Discussion] BGray210:
I'd be more than happy to help, but as you can probably tell, I am nowhere near the level I need to be for what you need.

Is the shim you spoke of the same or similar to JTAG?

Also, when I get back home in December I can work on learning IDA better and study up on reverse engineering, kind of difficult to do proper research on my phone with as many tabs and windows I open while learning.

I also had another question: Would purchasing Google ID locked or bad IMEI phones from ebay be an inexpensive way to test this root process or do they need to be fully functional and activated phones?
[LG V20 Guides, News, & Discussion] ThaHaloMilitia:
Are you guys still working on this?

---------- Post added at 07:59 PM ---------- Previous post was at 07:50 PM ----------

I'm so being patient. I have the LS997 on ZVA and I really need this lol
[LG V20 Guides, News, & Discussion] runningnak3d:
When I have spare time, yes. I am not putting as much effort into it as I was since LG can just modify the challenge / response with an update (or pull LAF completely). It just doesn't make a lot of sense to put SO much effort into something that can be nuked so quickly. If this was a new phone, that would be different, but I will absolutely not be buying a V30.

If LAF was an integral part of the OS (as in they COULD NOT get rid of it), I would be busting my hump since even if they did change the challenge / response it would just be a matter of finding the new algorithm. :)

-- Brian
[LG V20 Guides, News, & Discussion] laneyyy:
Is that something they would even do though? It's great that they're still giving us security updates, but they haven't seemed to change anything else.
[LG V20 Guides, News, & Discussion] runningnak3d:
They did with the G5. The original lafd that came with the G5 could run arbitrary commands using EXEC. So, it was just a matter of putting your files to be flashed on SD card and using dd. LG found out about that hole and closed it.
[LG V20 Guides, News, & Discussion] jcpowell:
Does this mean anything

https://medium.com/bindecy/huge-dirty-cow-cve-2017-1000405-110eca132de0
[LG V20 Guides, News, & Discussion] Zacharee1:
THE END IS NIGH
[LG V20 Guides, News, & Discussion] runningnak3d:
I am afraid it doesn't mean much for us right now:

From the article:

ls /sys/kernel/mm/transparent_hugepage/
ls: /sys/kernel/mm/transparent_hugepage/: No such file or directory

But for the heck of it, I compiled the POC:

[swango:~/dev/toolchain-6.4.1] $ bin/aarch64-linux-gnu-gcc -pthread -I./include main.c -o dc -static
adb push dc /data/local/tmp
[100%] /data/local/tmp/dc
[swango:~/dev/toolchain-6.4.1] $ adb shell
elsa:/ $ cd /data/local/tmp
elsa:/data/local/tmp $ ./dc
The beginning of the zero huge page: 0
[!] madvise(): Invalid argument
[!] Exploit failed.
255|elsa:/data/local/tmp $ exit

That isn't to say that there isn't some other way that they screwed up the patch. Trust me, I will be looking now that I know it works if you DO have transparent_hugepage:

On my Ubuntu box

[swango:~/dev/HugeDirtyCowPOC] gcc -pthread main.c -o hc
[swango:~/dev/HugeDirtyCowPOC] ./hc
The beginning of the zero huge page: 0
Racing. Gonna take a while...
Done 0x1000 bytes
Done 0x2000 bytes
Done 0x3000 bytes
Done 0x4000 bytes
Done 0x5000 bytes
(SNIP)
Done 0x1fe000 bytes
Done 0x1ff000 bytes
Done 0x200000 bytes
Success!

-- Brian
[LG V20 Guides, News, & Discussion] runningnak3d:
Well, here is some good news. I cracked challenge / response.

I am still not getting a successful write, but it goes MUCH faster when the device is opened correctly, and the data is sent in 260k chunks like LG UP does.

I am not giving an ETA, but I will say -- soon(c)

Soon -- copyright Blizzard Entertainment :)
[LG V20 Guides, News, & Discussion] Blaises:
Regardless of how things pan out, I really appreciate the time and effort you're putting into doing this! I'm sure I'm not the only one.
[LG V20 Guides, News, & Discussion] storm68:
Same here
[LG V20 Guides, News, & Discussion] nyterage:
been lurking on this thread for a while now, but as i just upgraded, i now have a LS997 i dont mind bricking if you would like a tester for that device.
[LG V20 Guides, News, & Discussion] BROKEN1981:
Really wish I had your brain lol
[LG V20 Guides, News, & Discussion] retro486:
Just sold my v20 but best of luck and I hope people pay that bounty... You most certainly deserve it for all that low-level insanity.
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=4771355]retro486[/MENTION] Thanks, but as I said, I don't take money for my time on hobbies. It will only become a money issue if I start bricking phones. :)

Right now, lafd fails with a nice error code due to me not having the SHA256 correct -- so I can just flash using LG UP and start again. (Hope I don't crash lafd -- lol).

What is really messed up is that there are backup partitions for all the important ones. aboot / abootbak / xbl / xblbak (heck, xbl even has xbl2 / xbl2bak).

Now this doesn't matter for this project, but because of the research, I found out that LG are idiots.

When LG UP flashes those important partitions, it flashes to the backup, and then once lafd has verified that the flash was good, it copies the new data to the primary. That is a really good idea.

Where the "idiotness" comes in, is the fact that they do the copy at the end of each partition flash instead of waiting until the ENTIRE device has been flashed. If they waited, then there would be NO WAY to brick your phone from a bad flash. Let's say your laptop dies part way through a flash of firmware that has a higher ARB version. If part of the firmware flashed, then the phone will be a brick since you now have a mix of say ARB 0 and ARB 1 firmware.

I also learned from this why some people have problems with LG UP recognizing their phones -- USB is *really* noisy, and the LAF protocol is VERY resilient -- MANY checks for data integrity. This is actually a good thing....

The fastboot Sahara protocol on the other hand, has NO checks. It flashes, and you better pray that it worked if you are flashing a critical partition.

-- Brian
[LG V20 Guides, News, & Discussion] storm68:
That's great info.. thanks
[LG V20 Guides, News, & Discussion] ronbb:
Hi guys please help me, I created a new account of xda only for a issue I am facing right now. I have a LG V20 H990DS version and I dumped userdata using LGUP dump feature so now I have ''userdata_COM'' file without any extension. I don't know how to open it and extract my folders in windows, please help me with this I very badly need my data because I did factory reset my phone and all internal data is lost, only thing remain is userdata dump file. sorry for bad English.
[LG V20 Guides, News, & Discussion] runningnak3d:
That dump is encrypted. Your data is gone. Sorry.

-- Brian
[LG V20 Guides, News, & Discussion] runningnak3d:
I don't suppose anyone has a buddy that works at Qualcomm? lol

It turns out that lafd can not only READ QFUSEs, but it can blow them as well. I was under the impression that LG UP checked the ARB QFUSE, and refused to flash if the KDZ had a lower ARB version -- and that was it. Turns out that is only part of it. When you flash firmware that has a higher ARB version than what is on your phone, LG UP does you the courtesy of blowing the new ARB version -- it doesn't wait for the phone to boot.

That doesn't change the fact that the boot loader ALSO can and will blow the higher version as well. That is why you can't just flash with TWRP.

So, how can we use this? IF we had a copy of the full engineering msm8996 data sheet, then we would know the address and offset for the debug QFUSESs. There doesn't appear to be any limitation on the address range that lafd can write, so if there was an open debug QFUSE, we could blow it with lafd. With the debug fuse blown, we could run unsigned code, and if we bricked our phone, we could use an unsigned firehose to recover.

Unfortunately there hasn't been an engineering datasheet leak in a LONG time.

This post is mostly wishful thinking .... now I am going to get my a** back to what can actually be accomplished :)

-- Brian
[LG V20 Guides, News, & Discussion] Americancosworth:
Just going to do a shout-out thanking OP for their work on this. While I enjoy having root on my phone, my better half is stuck rootless as she updated her phone before i could root hers...
[LG V20 Guides, News, & Discussion] steadfasterX:
Hi Brian

I hope you're aware of https://github.com/Lekensteyn/lglaf ?

Thanks for sharing your thoughts and maybe you can participate there as well ;)

Cheers

steadfasterX
[LG V20 Guides, News, & Discussion] runningnak3d:
Howdy [MENTION=5545101]steadfasterX[/MENTION] his research on this pointed me in the right direction when I started this. I actually credited him in the first post and linked to the repo :)

Unfortunately, that work is for an older version of lafd that allows any command to be executed with EXEC using sh.

Lafd now has a limited set of commands that can be run, when sent as the payload in an EXEC.

-- Brian
[LG V20 Guides, News, & Discussion] steadfasterX:
Oh ok then I may have over seen that link ;)

For the g4 the same happened (lafd getting more and more restricted) but you still be able to flash, backup and such.

I found out how to identify the ARB in a kdz and device and all that knowledge is in my upcoming project SALT. If interested watch my github repo ;)

It's made for the g4 but can in theory work with every LG.. Don't know if that's useful for you or not.

Cheers

sfX
[LG V20 Guides, News, & Discussion] popwar:
I mainly need root so I can install v4a and a rom with better battery life
[LG V20 Guides, News, & Discussion] OfficialVillager:
Hey Brian,

Seen your post on another thread asking how much that bounty was. I'm assuming you might have some good news for us. Have any updates? Love to see your progression. So far it seems youre the only one interested. Update 10r is here and I'm ignoring the stupid little notification in hopes we get root for q soon.
[LG V20 Guides, News, & Discussion] jcpowell:
Where is this bounty post?
[LG V20 Guides, News, & Discussion] OfficialVillager:
https://xdaforums.com/showpost.php?p=74696421&postcount=26

He replied here. The comment with his smirk emoji kinda triggered that he is close to some of us. Really hoping that I get root again soon. Didn't realize Q wasn't available yet. Can't boot people off our WiFi without it rn.
[LG V20 Guides, News, & Discussion] runningnak3d:
The bounty part of the post was a joke. I don't take money to liberate something that should have already been ours.

However, I *did* think I was close once I solved challenge / response. But now I have run into a checksum that must be sent with each write block. When I was looking at my packet dumps I had assumed it was trailing data since it isn't sent with an opcode.

I have not given up though, and this CAN be solved. As I have stated before, if I was a better reverse engineer it would have been solved a LONG time ago.

EDIT: [MENTION=8344690]OfficialVillager[/MENTION] You can upgrade to 10r. It is still ARB 1, so you can roll back to 10p or 10q if a kernel exploit is found, and ARB version doesn't affect the LAF project.

-- Brian

-- Brian
[LG V20 Guides, News, & Discussion] OfficialVillager:
I kinda thought that in the back of my mind. BUT if there is a legitimate bounty, you definitely deserve it. Maybe see if you can reach out to some of the rom developers and see if they can help you with anything. I could see where you'd need help with the reverse engineering, so let's see if we can get someone on board with you.
[LG V20 Guides, News, & Discussion] runningnak3d:
IT HAS BEEN CRACKED! I am now able to read and write to individual partitions. Yes, I can root the unrootable.

I had massive NIH (not invented here) syndrome. I have been trying to crack the LAF protocol by myself -- mainly because I didn't really code in Python (I am a C / C++ dude), and I was convinced that the information from Peter was only applicable to older versions of lafd, and only phones that have eMMC (which it was -- but a lot of it was still very valid). Our phones have a newer version of lafd, and use UFS NAND for storage.

Well, taking the knowledge that I had, and making a few modifications to his code to support UFS and the newer version of lafd, and viola:

python3 partitions.py --list recovery
# Flags From(#s) To(#s) GUID/UID Type/Name
2 1152921504606846976 10246 20613 9D72D4E4-9958-42DA-AC26-BEA7A90B0434 Unknown
7BF297B9-B37C-429C-4195-04AA6961C10F recovery

python3 partitions.py --list boot
# Flags From(#s) To(#s) GUID/UID Type/Name
1 1152921504606846976 6 10245 20117F86-E985-4357-B9EE-374BC1D8487D Unknown
DA2C381B-7D66-6D8C-4E7F-05CAA167EA0F boot

python3 partitions.py --dump boot.img boot
2017-12-11 09:57:59,817 partitions: INFO: Wrote 41938944 bytes to boot.img

file boot.img
boot.img: Android bootimg, kernel, ramdisk, page size: 4096, cmdline (console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 user_debug=31 ehci-hcd.park=3 lpm_levels.)

python3 partitions.py --restore ~/Downloads/twrp-3.2-h910.img recovery
2017-12-11 10:03:04,851 partitions: INFO: Done after writing 24641536 bytes from /home/swango/Downloads/twrp-3.2-h910.img

I need to clean my code up a bit, and I have some things hard coded. For example, eMMC has one block device with a bunch of partitions. UFS has multiple block devices. I want to clean the code up so that it will work with both eMMC and UFS (pass --emmc or --ufs), and I want to be able to pass the block device (--block sde or --block sda). Lastly, I want to do a few more tests, but expect a code release later today.

-- Brian
[LG V20 Guides, News, & Discussion] storm68:
Wow! :D your one smart man! Just wow!
[LG V20 Guides, News, & Discussion] MishaalRahman:
Will this work for only the V20 or will this finding help with other LG devices too?
[LG V20 Guides, News, & Discussion] runningnak3d:
It will definitely work with the G5 and probably the G6, and maybe the V30. Unfortunately it will only do the T-Mobile versions any good since they can unlock their boot loader. The V20 has the engineering aboot, so it will work on any V20 model.

I have done some research on unlocking the bootloader without using the eng. aboot. I haven't released it because until this work was done, it was useless and dangerous. I will need dumps from other models to figure out if it is even possible (they could have updated aboot to stop checking), and if it is possible, did it change between the v20, G5, G6, and V30.

-- Brian
[LG V20 Guides, News, & Discussion] steadfasterX:
so the v20 does not verify boot and recovery partitions? You lucky ones. the G4 does for sure..

btw the lglaf code is working even on Nougat (since 1 or 2 weeks) so I hope u tried the latest lglaf code with the v20? Not sure about UFS or not though.. :silly:

Just don't want let you to re-invent the wheel ;) but I'm glad that you find a way regardless and I'm excited for your code release :fingers-crossed:

Cheers and keep up ur good work!

btw: SALT has been released: http://tinyurl.com/SALTatXDA ;)

sfX
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=5545101]steadfasterX[/MENTION] Yes, the V20 does verify boot and recovery if you don't have an unlocked boot loader. Normally, that would only be the T-Mobile model, because while T-Mobile has pulled all the other fastboot commands, oem unlock is still available to them.

Luckily, someone got a leak of an engineering aboot for the V20 that works with every other model, and it is permanently unlocked.

So for us to root, we just need to flash aboot, and recovery (all models except T-Mobile H918) and just recovery for the H918. Once flashed, immediately boot to recovery, flash Magisk, and viola -- LG can go f*** themselves.

EDIT: and yes, I will be doing a pull request once I get the code cleaned up a little more, and consolidate it so that two versions aren't needed.

-- Brian
[LG V20 Guides, News, & Discussion] dudeawsome:
wohoo you the man root is back! Thanks a ton
[LG V20 Guides, News, & Discussion] loopytee:
Congratulations [MENTION=3167089]runningnak3d[/MENTION] I know you put many many many hours into this. And congratulations to all the LG device owners that will benefit from what you have accomplished!
[LG V20 Guides, News, & Discussion] androiddiego:
Nice job Brian! Thanks!
[LG V20 Guides, News, & Discussion] toastyp:
[MENTION=3167089]runningnak3d[/MENTION] congrats on the breakthrough!! I had a question relating to ARB. I know a couple of Sprint devs hard bricked their devices attempting to upgrade to zv8 firmware (ARB 01 i believe) and software. I thought cross flashing ARB 01 or higher firmware with the eng-aboot caused the devices to become unresponsive. If that's the case, once the dirtysanta devices have ARB incremented they won't be able to update, or am I completely wrong? I know TMobile is fine as they get to use the stock bootloader. Wondering if this new process will allow the dirtysanta devices to upgrade stock firmware and software regardless of ARB
[LG V20 Guides, News, & Discussion] runningnak3d:
ARB has nothing to do with whether firmware will or won't work with the engineering aboot -- it is just a fact of being newer that they usually increment ARB.

This is the first I am hearing of newer firmware not working with the eng. aboot. Granted I only have the H910 to test that with, but 10r is significantly newer than ZV8, and there are no issues.

But to address that issue, I will make an update later that will allow you to unlock your boot loader without using the eng. aboot. DISCLAIMER: That has only been tested on the H910, it may not work on other models, or I may have to do research to figure out if it is possible, and if so, what is different. That requires reverse engineering the stock aboot of the various models. Again, this is not a priority right now :)

EDIT: AHHH I think I know what you were asking now. Usually ABOOT has an ARB version, and the eng. aboot does -- but every piece of firmware can have a range, and the eng. aboot has 0x0 to 0xF -- every possible ARB version. Also, I can't imagine the eng. aboot having a problem with any version of the firmware since all it does is load LAF, RECOVERY and BOOT. I mean it does other things as well (fastboot mode), but it isn't responsible for loading things like the modem, that is handled by the xbl. That is why if you get a modem firmware mismatch, it will have an XBL_BLAH_BLAH error.

-- Brian
[LG V20 Guides, News, & Discussion] toastyp:
I could be wrong about how they bricked but the devs were me2151 and TeamDevDigital and I know they were attempting to update to zv8 which was the first Sprint firmware to increment ARB but that's it. Here's the thread. Last post details what happened attempting to update. https://xdaforums.com/v20/development/rom-ls997-stock-debloated-su-goodies-t3531923/page156

Just saw your update to the post. That's exactly what I'm asking about because I think that's what caused problems for them
[LG V20 Guides, News, & Discussion] runningnak3d:
So, I need a volunteer because I am not risking my phones, and I have seen several people say they would volunteer their phones in this thread, and others.

I have tested writing safe partitions (for example recovery). If something goes wrong, I can just use fastboot (and I have had to) to fix my phone.

I think I have all the kinks worked out, but this is VERY risky even with an already rooted phone like what I have been testing with, but even more so if you don't have root.

To root, you have to flash aboot, and I am just not willing to potentially blow up one of my phones. If you are willing to potentially have a brick, then send me a PM.

-- Brian
[LG V20 Guides, News, & Discussion] popper668:
PM sent
[LG V20 Guides, News, & Discussion] dudeawsome:
sent the pm and ready to test the root

---------- Post added at 01:34 AM ---------- Previous post was at 01:33 AM ----------

pm sent ready to test
[LG V20 Guides, News, & Discussion] BROKEN1981:
PM sent!

---------- Post added at 08:09 PM ---------- Previous post was at 07:53 PM ----------

Did you get to test it yet? If so, is it easy? Just want to know so that way if I can test, I'll make sure no one is around to bother me. LOL
[LG V20 Guides, News, & Discussion] dudeawsome:
Not yet he responded and said there was an issue where it wipes the partition and says writing new but doesn't actually wright to it and said that I will have to wait a bit longer before I could test
[LG V20 Guides, News, & Discussion] BROKEN1981:
Ahhh ok.
[LG V20 Guides, News, & Discussion] runningnak3d:
Yep, ran into another snag. I was testing on an already rooted phone, and writing recovery. It *acts* like it is writing, but doesn't actually write.

I have a couple of guesses as to why:

1 - When issuing an OPEN there is a huge payload. Part of that payload (the first 16 bytes) is the block device you want to open (/dev/block/sda or /dev/block/sde ... etc), the rest, I don't know -- yet. But if you don't send the complete payload, then you can't even issue an ERSE, BUT, lafd doesn't throw an error when issuing a WRTE. I am downloading the exact KDZ that I used for my dumps right now. I am hoping that the rest of the payload is SHA hashes of the partitions that COULD be flashed -- which is why it is so big. So if you OPEN /dev/block/sde LG UP looks to see what partitions and what order they are, and sends hashes in the payload of the OPEN. This would be real nice.

2 - There is a SIGN opcode that I have no idea what it does. But SIGN -- SIGNature ... could also be some checksum block that gets sent.

As I stated earlier, the LAF protocol has checks and more checks, and then redundant checks, and then checks of the checks, and if you don't get them all correct, then it won't even read.

I am not giving up -- I *REALLY* thought I had this cracked (I had NEVER gotten anything but an error when trying to write), but I am more motivated now than ever. None the less, I should have checked my work more before making an announcement. I apologize.

-- Brian
[LG V20 Guides, News, & Discussion] dudeawsome:
All good bro your efforts are highly appreciated and you're sure to get it to work soon. we believe in you!
[LG V20 Guides, News, & Discussion] BGray210:
I see you've made quite a bit of progress in the last few weeks. As I wondered how LG determines the legitimacy of kdz files, I stumbled across this old post: http://ryancuda.blogspot.com/2015/05/finding-official-lg-firmware.html?m=1

In it, the official kdz has what appears to be the hash key (if I read it correctly) and wondered if that would help with cracking the encryption or forging our own KDZ images.