yashsingh1/xdaforums huggingface dataset:
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=5958202]BGray210[/MENTION] Attaching a debugger to LG UP is easy. The hard part is attaching a debugger to lafd because we need BOTH algorithms. LG UP sends a challenge using some algorithm (probably tied to the static key), but then lafd sends a response that is generated by an algorithm based on the token that is sent by LG UP.

Now this isn't impossible on a rooted phone. Just need to compile up gdb and repack the LAF initrd. The problem is time -- which I don't have a lot of.

As I stated in another thread, I am now able to write to /dev/block/sde but because I am using an extremely inefficient hack, it is VERY slow. So slow that I don't know if it works.

Without being able to send a new challenge / response at the proper times, it just isn't feasible.

I have asked for help, and some people have stepped up, but then they disappear. If someone with good reverse engineering skills could step up, I could explain exactly what we need, and we could root any LG phone no matter what changes they make to lafd. They would have to eliminate it completely (which is a possibility if this ever does come to light).

I am not exaggerating when I say that Qualcomm and LG have come up with damn near the perfect security solution. It is in hardware -- the CPU. If they were to remove LAF (download mode) their phones would be unrootable without a hardware solution. It is only a matter of time before that comes to pass.

EDIT: My suggestion -- buy a phone from a vendor that is developer friendly (OnePlus, Razer, etc). Then you get an easy to unlock bootloader, and full fastboot. Some even offer a firehose in case you brick your phone. A firehose is a "shim" that the PBL can talk to. BUT it must be signed with the same RSA cert as the bootloader. It allows you to directly write to the NAND.

-- Brian
[LG V20 Guides, News, & Discussion] TheDannemand:
Got it, thanks.

Yeah we're still lucky in this regard on V30 -- although those of us with T-Mo variants don't feel so lucky after learning that our phones (despite having BL unlock, sort of) are the only V30s on the planet that cannot be easily rooted and cross flashed. All our hopes rest on Brian's LAF work!
[LG V20 Guides, News, & Discussion] Wiebenor:
Hmm... just did the 180 mb update and im still at December 2017 patch level except I'm on ZVB version instead of ZVA... note... no wifi or service on device, and its to strictly be for wifi
[LG V20 Guides, News, & Discussion] ph4nt0m117:
We're still gunna get a full lafsploit release in august, right?
[LG V20 Guides, News, & Discussion] runningnak3d:
When I have rooted Oreo on my H918 and my H910, I will release every bit of code and documentation that I have. If I ever did upgrade, it will not be to an LG phone, I don't care what the price is, unless by some miracle they get their heads out of their asses and release the V40 with a removable battery, but I think that ship has sailed.

So, since this will be my last LG phone, and Oreo will be the last update the phone gets, I have no reason to hang on to the various holes I have found .. most of which still apply to the G6, V30, V35, and G7.

-- Brian
[LG V20 Guides, News, & Discussion] ozkaya:
I think there is a chance that 8.0 won't be the last update V20 gets. 9.0 will be released within the 2 year update window and most flagships got 2 major updates up to this day(some even got 3) and 8.0 will be the 1st update for V20. I say 50% or more chance for 9.0.
[LG V20 Guides, News, & Discussion] me2151:
No not even close. there is 0% chance of 9.0 on the v20 officially.
[LG V20 Guides, News, & Discussion] Zacharee1:
-100%
[LG V20 Guides, News, & Discussion] me2151:
Or that
[LG V20 Guides, News, & Discussion] pro_granade:
go back to temp
[LG V20 Guides, News, & Discussion] ph4nt0m117:
I just want to root my LS997 man IDC about 8.0 or 9.0.
[LG V20 Guides, News, & Discussion] runningnak3d:
I already stated this in the dedicated LS997 root thread, but I will say it again....

Getting root is a lot harder than keeping root. In order for the LS997 to get root again, one of four things has to happen:

A new engineering aboot leaks that is ARB 1

ARB gets incremented on the unlocked US996

ARB gets incremented on the H915 AND they don't patch a hole

An engineering boot leaks that has dm-verity disabled

I can write to the LS997 right now, but it does no good if the bootloader can not be unlocked -- you would just bootloop.

Folks that have rooted LS997s are are running the latest updates are doing so by mixing VS995 firmware which is still ARB 0.

The moral of the story is -- don't ever flash a higher ARB firmware unless you know for sure that there is a root method. This doesn't do any good if the device was bought new, or even used, but the seller upgraded it.

For example, we now have ARB 0 F800 firmware. If the H910, or VS995 or (insert model here) increments ARB, we still have firmware that we can use -- unless you have a model that can't get signal with an ARB 0 modem.

-- Brian
[LG V20 Guides, News, & Discussion] mattgyver:
Well, you're a little closer, Brian! Sprint started pushing 8.0 to their V20 variant today!
[LG V20 Guides, News, & Discussion] sykosoft:
I have a separate problem. I'm not concerned with maintaining root, or really, even rooting in general. I have 2 x V20 997, that simply won't activate on Tello because LG got rid of all the programming methods. Anything that can be done about that particular problem with current methods? I really just want to get the V20s activated and programmed to work on the MVNO.

Michael
[LG V20 Guides, News, & Discussion] runningnak3d:
Nope, not without rooting. If Sprint has locked out the ability to change APNs, then you are stuck on Sprint.

-- Brian
[LG V20 Guides, News, & Discussion] DE52:
I just got an OTA for 8.0 on my H915. I'm honestly surprised that LG even updated the V20....should I stay on nougat in case ARB wasn't implemented in the way it's expected or in case holes were plugged? I'm not sure what the progress for my model is so just being safe :good:
[LG V20 Guides, News, & Discussion] spocko:
I have 2x LS997 operating on Twigby (another Sprint MVNO). No manual settings adjustments were necessary. I'd be surprised if Tello is different. Have you tried going into settings> backup & restore> reset network settings? I had to do that recently to fix an issue with MMS.
[LG V20 Guides, News, & Discussion] cnjax:
This is a development thread for root, not a discussion thread for the Oreo release, there are numerous threads about it already, so please don't clog up this thread with your off topic posts
[LG V20 Guides, News, & Discussion] DE52:
The goal of my post was to inform the dev that Oreo has been released for my variant since all variants receive Oreo at a different time. I also asked about ARB, etc because I don't know if he looked into the update of my variant as yet (since I don't know when it began rolling out exactly for others with my variant). It's not as if I asked if I will have root or can I have root. I only asked if others would recommend to stay on Nougat. I didn't know it would be considered off topic to do so, but thanks :good:
[LG V20 Guides, News, & Discussion] cnjax:
Again there's was already a thread about the 915 oreo release a day ago so everyone knows it was released. Again your questions belong in those threads not here.
[LG V20 Guides, News, & Discussion] runningnak3d:
Talk about a revelation. Thanks to [MENTION=479015]dark_prince[/MENTION] almost bricking his phone, I *THINK* I have solved the writing issue. I don't mean being able to arbitrarily write anything to any partition, I am talking about writing hashed partitions, with the SIGN payload, just like LG UP.

This has eluded me for a while. I was able to, and then I wasn't, and then I was, and then I wasn't. It made no sense.

I did packet dumps of MY writing, and the WRTE (that is an opcode) matched LG UP perfectly, yet I would get an fsync fail.

Well, when LG UP talks to lafd, it does several INFO GPRO / INFO SPRO packets before it does anything else.

I had assumed (and go back and read this thread and look at how many times my assumptions have bit me in the ass) that was all ARB checks and MODEL checks -- and they are.

What I *DIDN'T* realize is that part of the signature in the SIGN payload identifies what model the signature came from.

So, you can send a valid SIGN payload, and you can send a valid partition that has a signature IN the payload, but lafd will ignore it if it is from the wrong model.

So, we just need to spoof the INFO SPRO to match the model that we are trying to flash.

This is all theory, but like usual, I have had a few beers, and I wanted to get this down in text in this thread.

OPCM CHEK and CHEK CLER also *probably* come into play.

The goal here, is to be able to flash any legitimate KDZ onto ANY LG phone.

EDIT: Before someone misunderstands and thinks this is a way to get around ARB or the RSA signing of the firmware -- nope -- not going to happen.

This -- if I am correct, just makes it so that we can flash any KDZ onto any model LG phone without hacking LG UP.

EDIT2: I know some of you may not see this as a plus, but remember, I have a ROOTED SIGNED laf partition ............ ;)

[MENTION=5545101]steadfasterX[/MENTION] Tagging you, because I know you are going to want to be on IRC tomorrow. Also, I think I figured out which commit broke MM writing for you, but I need some details.

-- Brian
[LG V20 Guides, News, & Discussion] Zacharee1:
Any KDZ onto any LG? This is constrained by nominal model, right? (V20, V10, G5, etc)

Even then, does that make it possible to flash, say, a US996 firmware to the H918, which has its own unique partition layout for some reason?
[LG V20 Guides, News, & Discussion] runningnak3d:
Absolutely not!

I will quote from my post:

The H918 doesn't have a different partition layout, it has a different RSA key in the CPUI.

So, an G5, V10, V20, G6, V30 that all have the same RSA key (which all models do EXCEPT the TMO model), CAN flash the firmware.

Now, that is not saying it is going to *work*, just saying they wouldn't be bricks because of the RSA signature.

I have already proven this with the G6 H872 (TMO) version flashing the H918 10p laf partition in order to have the COPY opcode.

This will just make it a lot easier to do so. With the H872, they have to use LG UP, and pull the USB cable, and then flash the KDZ for their model using partition DL mode, and excluding laf.

EDIT: The RSA signature has several OUs. One of those is ARB. Luckily they haven't implemented any of the others -- yet.

-- Brian
[LG V20 Guides, News, & Discussion] Zacharee1:
I thought it was a different partition layout, not a different signing key. That makes even less sense...
[LG V20 Guides, News, & Discussion] dark_prince:
There is something really strange about partitions. I flashed my phone with H915_10e and rooted it on H910_10m (as normally I do on my H910PR). I flashed back-to-back within couple days LOS 15.1, LOS14.1 and resurrection roms (with gamma kernels for H910) and yet LGUP recognizes my phone as unknown on an H91510e and refuses to accept it. How come the information about H91510e is still there in-case there is a separate partition other than system and boot where the identifier is written. Talking noobsense here.

Secondly, We do have genuine LG Logo momentarily on engg. boot as well we just don't see it for more than half a second unless we use the button combo to enter TWRP (before factory reset screen). My phone was stuck there despite having unlocked bootloader and TWRP whenever I rebooted it after flashing a rom. I'll standby here or continue my effort of making the phone recognized in LGUP in the meantime.
[LG V20 Guides, News, & Discussion] Wiebenor:
Just to clarify for any others here who might also be wondering... when you post your big data dump of all your work, will you include which phones will work with it, and which will not??? Im assuming you will, but would like a confirmation on that...
[LG V20 Guides, News, & Discussion] Stuntn_4_Ghost:
Uhhhhh I actually used lg bootloader unlock tool with my us996 from US Cellular and it worked. This was maybe about a month ago.
[LG V20 Guides, News, & Discussion] christopherrrg:
That's because US996 is a part of the official unlock list.

Mostly any LG devices beginning with US means usually means unlocked; otherwise you'd have a device that begins with H (H990, H910, H918).

I thought I'd edit my response as there are certain versions where the model # lines up with the unlocked version but are in fact stripped of fastboot commands and or not officially unlockable. So your mileage may vary.
[LG V20 Guides, News, & Discussion] Zacharee1:
The US996 refers to the US unlocked variant, but it also refers to the US Cellular variant, which isn't supposed to be unlockable.
[LG V20 Guides, News, & Discussion] christopherrrg:
Yeah I threw in a ninja edit mentioning that hehe
[LG V20 Guides, News, & Discussion] chuckRN:
I'm not really sure if i should post this here.

I'm having a bit of a situation. I previously rooted my f800l with dirtysanta method, then i came across a thread stating that we can try dirty flashing an oreo kdz firmware using the patched lgup with the partition option, leaving out boot, aboot, and recovery.

I was on "superv20 rom 4.0" previously, so i unrooted and tried to flash "f800l10e" stock using lgup, unfortunately, i clicked on "f800l20e" instead. When it was done, i did a factory reset and tried to flash f800l10e but it wouldn't finish.

It always gets stuck while flashing "lafbak" and an error message pops up. I tried flashing "f800l10e" a couple of times but no success on each one. Tried using different computers, and different lgup version as well, including the patched lgup.

Now i'm stuck on stock oreo with no way to root, and no way to downgrade. Can anyone give me some advice, or point me in the right direction?
[LG V20 Guides, News, & Discussion] cnjax:
You were warned by me in another thread that if you flashed oreo you'd lose root. So now live with it, until a root solution becomes available.
[LG V20 Guides, News, & Discussion] userwaldo:
I tried the LG Booatloader Unlock site and it said my US996 from US Cellular was not supported. So I ended up using the DirtySanta Method. Now I have to deal with annoying static screen on every boot. I've tried a few tricks to make it more bearable, but nothing that has been too successful.
[LG V20 Guides, News, & Discussion] chuckRN:
Ah, shoot. I should've been more careful. Hopefully, someone figures out how to root oreo.

Thanks though.
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=9473225]justmike80386[/MENTION] Sent me a packet capture of him flashing the Verizon OTA via LG UP's FOTA upgrade option.

Unlike the other modes (refurbish, upgrade, partition DL) this doesn't use the standard laf opcodes (WRTE, SIGN, KILO, INFO, etc) .. it uses HDLC.

It is going to take a bit of work to figure out what the commands do, but it appears that there is something similar to INFO GPRO that return the properties of the device (H918 on 10p firmware, etc), and another that I have mostly figured out is a: "Start streaming data" command. Once that command is issued, LG UP literally streams the data and there are no replies from lafd.

So one of the next big pieces, is going to be to fully document the layout of the OTA bin file.

After tearing through the file, I have found out how it is verified with stock recovery -- using a signed zip file. However, that file isn't sent by LG UP, and lafd doesn't have the keys to verify it anyway. The only keys that lafd has, are the ones to decrypt the SIGN payload when flashing a normal KDZ.

So, if we can document the file format, it should be possible to craft up a .up file that can be flashed via LG UP, that unlocks the bootloader and installs TWRP, root patched boot, and a patched system image.

Right now, that wouldn't do the V20 any good, but in the future as ARB gets incremented, and more holes are patched, we need every advantage that we can get.

Once I get a few more things worked out, I will post all the commands I have decrypted so far, and the file format.

-- Brian
[LG V20 Guides, News, & Discussion] Josh McGrath:
[MENTION=3167089]runningnak3d[/MENTION]

That's awesome. The work never ends. If this indeed ends up being a working method, I'm going to pick up a g7 or maybe v40 even over my v30.

Thanks again for your hard work with the LG community
[LG V20 Guides, News, & Discussion] Ken C:
Curiosity begs me to ask if this would work for any lg device?
[LG V20 Guides, News, & Discussion] runningnak3d:
All current versions of laf .. so yes.

The thing is, being able to write arbitrary data is only half the battle. Unlocking the bootloader is the other.

Starting with the SD835 Qualcomm encrypted abl (formally aboot), so it is near impossible to reverse engineer.

-- Brian
[LG V20 Guides, News, & Discussion] Ken C:
Thanks for the explanation. The Bootloader comment, is that device specific?
[LG V20 Guides, News, & Discussion] askermk2000:
Hey Brian :)

Just saw this in the news, seems like a game that might interest you :angel:

Root is a terrific and fully asymmetric woodland wargame
[LG V20 Guides, News, & Discussion] cnjax:
Lol :D
[LG V20 Guides, News, & Discussion] BAFLGV20:
Nothing like playing a game of ROOT, with BOOTLOOPS.

Just had to say thanks to all that was involved that made this possible. I'm finally able to appreciate a device that I knew had great potential.

I sent LG an e-mail letting them know about there thermal-engine-8996.conf file and how the temp threshold was set way to low, and then a copy of my version and what i thought it should be. There response said something about it being set like that for battery life and efficiency.

P.S. i said that's why they make BIGGER batteries. and removable ones. So hopefully when the LG V45 comes out, it will have at least a 4000mAh battery. I got the V35 in my sights for now. But only if I can have my ROOT. without BOOTLOOPS of course.

---------- Post added at 08:33 AM ---------- Previous post was at 08:32 AM ----------

Just had to say thanks to all that was involved that made this possible. I'm finally able to appreciate a device that I knew had great potential.

I sent LG an e-mail letting them know about there thermal-engine-8996.conf file and how the temp threshold was set way to low, and then a copy of my version and what i thought it should be. There response said something about it being set like that for battery life and efficiency.

P.S. i said that's why they make BIGGER batteries. and removable ones. So hopefully when the LG V45 comes out, it will have at least a 4000mAh battery. I got the V35 in my sights for now. But only if I can have my ROOT. without BOOTLOOPS of course.
[LG V20 Guides, News, & Discussion] iodroid95:
I am not trying to bump the thread, I thought it was funny!!!
[LG V20 Guides, News, & Discussion] Wiebenor:
Ok... it appears that the last post here was nearly a year ago, (or is that 2months???)so i must ask, how's rooting this phone coming along??? Any progress with getting the US versions that have qfuses to be comoatible??? someone posted a while back that mine likely wouldn't be compatible because of qfuses whatever the heck they are...
[LG V20 Guides, News, & Discussion] misc6207:
I follow the telegram chat and the activity there is next to nothing. I have officially given up that this phone will ever achieve root/BL unlock.
[LG V20 Guides, News, & Discussion] IndifferentBear:
Lol, there is root. What are you talking about?
[LG V20 Guides, News, & Discussion] Wiebenor:
I dont like asking this question, but did you just clickbait your way here, or have you been following this??? Not to mention, do you know what this thread pertains to???

This thread was started when certain V20s started rolling out updates that effectively made the phone un-rootable including using Dirtysanta method... the thread starter was discussing LAF modes roll in the process, so as to make an exploit possible, which, from what I've read as recently as last year, was completed, but he would not release the data dump of his findings and exploit instructions, until the next version of the OS was pushed to ALL carriers... in another post in this thread it was stipulated that not all phone varients are necessarily compatible with this new update, including my varient... in my case someone said it had to do with something called QFuses... i still don't know whether or not mine is rootable for sure, using the OP's method...

Sorry if it sounds like I'm mad at you or something, cause I'm not, but I have been watching this thread pretty closely, for a very long time, and an out of the blue quote saying "there is root, what you talking about" is kinda, well, something only those who just see a thread and decide to post a comment just for the heck of it, do...

---------- Post added at 07:39 AM ---------- Previous post was at 07:15 AM ----------

I just wish that phone designers and engineers wouldn't disable these things fully... or at least make a way for you to unlock and root it...
[LG V20 Guides, News, & Discussion] IndifferentBear:
well lets just say, its something called.. "i bought my own PC, and keyboard. there for, i should be able to say what i want." at least that's what i want to say, but for the sake of not causing any bull**** drama.

Sighs

yeah, you could say i just clicked all the way through here, and typed something. and half of the stuff you typed, i didn't even read, i kinda just scanned through it. so in a way, i don't really care what this thread was about haha. i just saw a comment that mentioned the lg v20 not having root, and i responded.

sorry, if i bothered you.

---------- Post added at 04:26 AM ---------- Previous post was at 04:21 AM ----------

well lets just say, its something called.. "i bought my own PC, and keyboard. there for, i should be able to say what i want." at least that's what i want to say, but for the sake of not causing any bull**** drama.

Sighs

yeah, you could say i just clicked all the way through here, and typed something. and half of the stuff you typed, i didn't even read, i kinda just scanned through it. so in a way, i

don't really care

what this thread was about haha. i just saw a comment that mentioned the lg v20 not having root, and i responded.

sorry, if i bothered you.

although, i do apologize if i sounded snotty and rude when i replied. I'm not in the best mood right now, haha.

apologies again, kind sir.
[LG V20 Guides, News, & Discussion] Wiebenor:
Oh, you're good... i just thought that a recap might help others in the future, as well as yourself... this is getting to be around 125 pages, so it was probably due time... im not even sure if it's root anymore, that Dirtysanta does, as I've given up on ever getting that stuff to work on my device long ago... my device Patch Level is way too new, and my device may not even be a compatible provider chipset, curse the LG gods... however, if the stuff in this thread works, and even better, works on my device then I can (I think) roll back my OS to a pre-2018 patch that is compatible with Dirtysanta, and then put a custom rom on it, once it's unlocked...
[LG V20 Guides, News, & Discussion] sbacham:
Is there any patched LG UP tool that flash kdz without checking Anti roll back? because I want to do refurbish in LG UP tool.But I could not ,it always checks anti roll back and stops at 4%
[LG V20 Guides, News, & Discussion] Phoenix591:
If you somehow get ARB 0 firmware onto an ARB 1 phone you get a permanently bricked phone for your trouble. ARB is literally burned into fuses (it can burn more to go up in ARB, but you can't unburn a fuse) embedded into the soc (think cpu), its never going back to 0. If you have an H918 you can still root via going back to 10p which is still arb 1 so it won't trip anything, but if you have an LS997 you are screwed.
[LG V20 Guides, News, & Discussion] lamepsycho:
How do we check the Current ARB status? Is there any thread related to ARB information?
[LG V20 Guides, News, & Discussion] cnjax:
If you are on 10p or later it's arb1