yashsingh1/xdaforums huggingface dataset:
[LG V20 Guides, News, & Discussion] runningnak3d:
Well folks, we are back in business thanks to a post on the original lglaf repo. Someone posted a sniff of how MISC WRTE and COPY work, and now I understand why they were pulled from the latest versions of lafd.

I am modifying the tool with the new info, but I won't be able to test till tomorrow.

This post is mainly to warn you not to install any updates in case they increment ARB. Right now ALL models can roll back to a version of lafd that still has the opcodes needed, but trust me, they are closing this hole.

-- Brian
[LG V20 Guides, News, & Discussion] ki11aprime:
Following this closely I have a H918 that is lock, but the TMO app isn't working for me so my only option now is the root method thanks for all your efforts you the real MVP..:highfive:
[LG V20 Guides, News, & Discussion] DE52:
In my case, don't have to worry about updates. Canadian carriers suck at pushing updates anyway :p in fact LG in general doesn't update that much in the first place. Anyway, hoping to see a breakthrough soon. Keep up the hard work!
[LG V20 Guides, News, & Discussion] omariscal1019:
[MENTION=3167089]runningnak3d[/MENTION] have seen the post in the g6 forum is it similar to what ur doing?
[LG V20 Guides, News, & Discussion] dudeawsome:
Can you please share the link?
[LG V20 Guides, News, & Discussion] omariscal1019:
https://xdaforums.com/tmobile-g6/how-to/information-how-to-root-t-mobile-g6-t3585994/page7

Page 7
[LG V20 Guides, News, & Discussion] runningnak3d:
Can you provide a link? There are a lot of threads :) EDIT: posted link while I was posting -- thanks.

The work that I am doing here will apply to the T-Mobile version of the LG G6 when it is complete if it can be rolled back to a version that has the COPY opcode in lafd, OR they used the same RSA key in lafd as they did the V20. I checked the H932 (T-Mo V30) and the key is still the same, so they will be able to flash the H918 laf partition. If you want to supply a link to the latest and oldest firmware that can be flashed on the T-Mobile G6, I will check them.

Unless a debug / engineering aboot leaks for the G6 or abl for the V30, there will never be root for any models that can't unlock their bootloaders.

EDIT2: Yes, that is exactly what I doing here. Finding a hole in lafd to allow an image to be flashed that doesn't have a hash.

-- Brian
[LG V20 Guides, News, & Discussion] omariscal1019:
[MENTION=3167089]runningnak3d[/MENTION] would this help

https://xdaforums.com/tmobile-g6/development/stock-h720-10h-rom-imgs-kdz-t3607236
[LG V20 Guides, News, & Discussion] runningnak3d:
So, here is where I am with this....

First a little refresher on how lafd flashes KDZs. These are just the opcodes with comments (also leaving out all the challenge / response authentication):

OPEN -- the payload is the block device with some bytes to indicate things like read only or write. I have been using the payload as-is from sniffs. I have not completely decoded this since I have had no reason to. This also gives you your file descriptor.

SIGN -- The payload is a list of partitions to be flashed with the hashes, size, etc. This is signed with an RSA key -- it can NOT be recreated without the RSA private key

WRTE -- This writes the data to a temp area. The start packet has a write mode of 0x18, all intermediate packets have 0x09, and the final packet has a write mode of 0x29. The 0x29 tells lafd to compare the hash and flush the buffer to the actual block device. If you haven't sent a SIGN, then this fails with an fsync fail.

CLSE -- This just closes the file descriptor.

That is it. There are other opcodes that LG UP uses: INFO GPRO and INFO SPRO. These are used for things like determining if you are trying to cross flash firmware, ARB version, etc. But they aren't needed to get lafd to flash.

Now, with this post I have been given insight into how the COPY opcode works. This is copy2 flashing:

OPEN -- same open as above

MISC WRTE -- pretty much just data

IOCT -- disables write protection

COPY -- forces the flash

IOCT -- enables write protection

CLSE -- same as above.

This works great, except that I am trying to test on an SD card to so I don't brick my phone. Unfortunately, that isn't going to cut it. I don't have a valid OPEN for /dev/block/mmcblk0.

I was REALLY hoping that the person that posted that info would post their full packet capture -- that would include a valid OPEN.

I am going to give them another day or so, then I will just risk this on my own phone.

Considering both myself and [MENTION=5545101]steadfasterX[/MENTION] bricked our phones by providing invalid values to COPY, I know it writes -- it is a matter of are the eMMC parameters the same as UFS (that partial sniff is from an LG Stylo 2 which is an eMMC device). If not, I will end up with another brick.

-- Brian
[LG V20 Guides, News, & Discussion] omariscal1019:
[MENTION=3167089]runningnak3d[/MENTION] so is the firmware i link still good for the lafd from he g6
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=1341197]omariscal1019[/MENTION] I checked lafd on the link that you posted and it still has COPY. But I also checked the public key that is contained in lafd and it matches the H918. So if ARB has been incremented, then you can flash the H918 10p laf partition.

OK, with that said, another progress update. xnoxcdm posted the full packet capture from his flash, and I was wrong about a few things (or they only apply to eMMC devices).

In his sniff, there is no OPEN (well not for flashing). It goes:

MISC WRTE

IOCT

COPY

IOCT

So, I did a couple of tests, and I thought IOCT toggled write protection -- it doesn't. It actually creates the file descriptor. From the sniff it is: IOCT 0x28,0x1261. This creates an FD of 0x28, and on his device the block device that FD is attached to is /dev/block/mmcblk0. When I issue the same command on the V20, it gives me a FD, but that FD is attached to /dev/block/sda -- we DO NOT want that. We don't want / need to flash any of the partitions on sda, we need sde.

So, I played around in IDA for a bit trying to figure out what the 0x1261 meant, but I came up empty. The good news is that we don't need IOCT to create a FD, we have good old OPEN that will do that for us. I am guessing that the reason that the Octopus box uses IOCT instead of OPEN is because whoever makes it doesn't have a valid OPEN payload --we do thanks to my sniffs...

So the final order for flashing will be:

OPEN

MISC WRTE,0xF80,size + payload (what is being flashed) // I don't know what the 0xF80 means, and it doesn't matter for now.

COPY FD,4FE,size,offset // I don't know what the 4FE means, and for now that doesn't matter as well. FD is obtained when the OPEN is issued.

CLSE FD

This is a massive abuse of the MISC WRTE opcode. MISC WRTE (in a NORMAL flashing scenario) is used to write to the misc partition to avoid bootloops. When you get an OTA, a string is written to misc to instruct the phone to boot into recovery. If for some reason you received an OTA but immediately went to download mode and flashed a KDZ, you would be stuck in a bootloop with no way to fix it if lafd didn't zero out that string.

The people over at Octopus have apparently figured out that MISC WRTE can be abused with the COPY command. I love it. I could have looked at this decompiled code for years and probably never found this. That is why LG is closing this hole -- boxes.

I want to look over this sniff a bit more to make SURE I didn't miss anything, and I also want to try and figure out what 0xF80 and 0x4FE mean. I am already passing an OPEN payload that I don't fully understand, I don't like just passing arguments without knowing what they do -- even if it does work.
[LG V20 Guides, News, & Discussion] runningnak3d:
double post
[LG V20 Guides, News, & Discussion] TheDannemand:
This is fascinating! Thank you, as always, for your insight and hard work.
[LG V20 Guides, News, & Discussion] pro_granade:
So if we want to use a root method that comes out of this do we need to buy a Octoplus box?
[LG V20 Guides, News, & Discussion] SMTB1963:
Fantastic news! Got my fingers crossed...GOOD LUCK [MENTION=3167089]runningnak3d[/MENTION]

:good::highfive::fingers-crossed::D
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=5083130]pro_granade[/MENTION] No. The sniff that helped me finish the reverse engineering of copy2 came from an Octopus (Octopus or Octoplus -- in the sniff it is identified as an Octopus, and when I Googled for it, the site uses both terms).

Since I am replying, might as well get another status update out there. The normal WRTE opcode has the data broken up into 1 meg chunks like so:

WRTE 0x18 // 1 meg

WRTE 0x09 // 1 meg

WRTE 0x09 // 1 meg

WRTE 0x09 // 1 meg

WRTE 0x29 // 300k

But MISC WRTE takes all the data in one shot:

MISC WRTE // 24 megs

I am getting USB bulk write timeouts though when I try and send a partition of any normal size. *UGH*

-- Brian
[LG V20 Guides, News, & Discussion] runningnak3d:
Any of you guys any good with Python and pyusb or libusb? I have set the timeout to something insane and I still get a timeout.

Since all the data has to be sent at once, I am just reading it all into memory, and then doing a single call:

size = os.path.getsize(local_path)
data = f.read()
laf_write(comm, size, data)

and laf_write:

def laf_write(comm, size, data):
"""Write the whole partition in one go"""
write_cmd = lglaf.make_request(b'MISC', args=[b'WRTE', 0xF80, size], body=data)
comm.call(write_cmd)

Finally the data is sent to the device with a simple:

self.usbdev.write(self.ep_out, data, 0)

The third parameter with pyusb is timeout. 0 is supposed to be no timeout, but I have tried with a really big value, and there is no change. This makes no sense.

I am giving up for the day.

-- Brian
[LG V20 Guides, News, & Discussion] runningnak3d:
So, I thought pyusb or libusb would take care of breaking up bulk transfers into normal USB frames auto-magically -- nope. So of course the bus is going to timeout when sending 41megs as one huge USB frame -- lol.

No biggie, I just need to break the stream back out into 1 meg chunks, but only the first chunk with have the MISC WRTE opcode and header. The remaining frames will be just appended data.

More to come soon.

FYI - I *AM* able to write, and it is what I want where I want when just passing the opcodes manually:

OPEN + sde open payload (It is really long so not posting it)

MISC WRTE 0xF80,10 0123456789

COPY 40,0x4FE,10,10246

CLSE 40

then

OPEN + sde payload

READ 40,10246,10

CLSE 40

Gives me back 0123456789

So that proves that this will work, just need to scrap this old script and write a script from scratch instead of trying to hack this in, since this script has a lot of stuff that no longer applies (and won't even work) on new versions of lafd.

I was trying to make it a "one size fits all" for older versions of lafd, and for eMMC and UFS devices, but that just adds a lot to debug when something goes wrong.

-- Brian
[LG V20 Guides, News, & Discussion] Josh McGrath:
[MENTION=3167089]runningnak3d[/MENTION]

Man, I wish I could help with all the stuff you're working on, but it's way over my head.

BTW, I have python 3.7 installed and my replacement phone is ready to be picked up. I have two weeks to pick it up, so no hurry if you still want to test.

---------- Post added at 06:24 AM ---------- Previous post was at 06:19 AM ----------

[/COLOR [MENTION=3167089]runningnak3d[/MENTION]

Damn buggy app- double post
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=5070414]Josh McGrath[/MENTION] Just being willing to test for the H932 users is awesome dude. I got really busy at work, so I may not be able to finish the rewrite till this weekend, but I will have something for you to test real soon.

BTW - When I first upgraded to the V20 from the V10, I had it for about a week and I bricked it by flashing the H918 aboot. I knew nothing about firmware signing, and I figured: "Hey, aboot is aboot. I have T-Mobile, so I can just convert my H910 into an H918". I even emailed LG support and asked if it is the same hardware, and they said yes (and it is -- the H918 and H910 are identical except for the RSA key in the CPU). So after they repaired it, I went on a mission to try and learn as much as I could about security on Android in general, but specifically Qualcomm's and LG's implementation. If you look at posts on here from me from 8 months a year ago (man time flies), I am a total n00b. Everyone has to start somewhere.

Sorry for the long rant...

TL;DR: It is never too late to learn :)

-- Brian
[LG V20 Guides, News, & Discussion] BROKEN1981:
NOOOOOOOOOBBBBB!!!!!!

LoL j/k
[LG V20 Guides, News, & Discussion] pro_granade:
Weird side question. So you can sim unlock ZV8 through a Z3X box, so why not downgrade whatever firmwares are ARB1 to ZV8 to get SIM unlocked?
[LG V20 Guides, News, & Discussion] Nickvanexel:
Yes please let me know any possible way to unlock this damned phone. Theres got to be a way to do it even on newest firmware. I actually just updated to the newest zvd firmware that was pushed to my phone a couple days ago hoping maybe Sprint would send the unlock signal with it but was stupid of me i guess.
[LG V20 Guides, News, & Discussion] Josh McGrath:
Deleted to not contribute to the OT posts.
[LG V20 Guides, News, & Discussion] jimenezboy:
This doesn't fit in with the OP's post, but you probably posted because of the huge popularity of the post. Search the V20 forums, there are several threads that address the issue, like this and this
[LG V20 Guides, News, & Discussion] runningnak3d:
You guys aren't going to believe this shiz. I just flashed TWRP onto my H918 by total accident.

I was trying to solve the MISC WRTE / COPY (copy2 flashing), and I needed a test file descriptor. I knew that indirect flashing -- RSVD IDDD opens /data/idt.cfg for writing. I wanted ANYTHING except my onboard storage so I didn't brick my phone. When I went to make sure that idt.cfg was in write mode, I MEANT to type lsof (list open files), but what I typed was ls-f, and I got file not found. Then I typed dmesg to try and find out what just happened, and I didn't get anything. So then I typed ls-f again, and this time I got dmesg not found.

So I figured I would try passing some things as the payload: RSVD IDDD /system/bin/sh

ls-f did nothing. So I thought it was running a shell and exiting. Nope.

Finally figured out that what it was looking for was an update file. So.... RSVD IDDD /storage/external_SD/SoftwareUpdate/update.zip

and....

[LAF] Start flashing HW user partition 0
[LAF] success to close handle to flash driver

[LAF] flashing done.

Turns out that download mode doesn't verify the integrity of update.zip when it is called via indirect flashing. As in it doesn't check to see that it was signed with the keys that are usually in /res :)

Root is for real coming soon...

Oh, the best part, this is available in ALL current versions of lafd on any and every LG model.

Any LG model that can unlock their bootloader, or has an engineering aboot (G6 and down) or an engineering abl (V30 and up)

-- Brian
[LG V20 Guides, News, & Discussion] Zacharee1:
O_o

That's a pretty big security hole, even by LG standards.

Can this be patched through a software update, or only in new models?
[LG V20 Guides, News, & Discussion] jcsww:
Does this also mean we will eventually be able to flash one model to another successfully?
[LG V20 Guides, News, & Discussion] ivoh95:
Awesome! Maybe i can get my h918 sim unlocked without losing root now since i cant do it with an unlocked bootloader and root. We appreciate all your hard work and persistence!
[LG V20 Guides, News, & Discussion] runningnak3d:
They can pull indirect flashing just like they did copy2 flashing. However, since ARB doesn't apply to the LAF partition, if you have it now, you will always have it since you can always roll back.

-- Brian
[LG V20 Guides, News, & Discussion] Revolts:
I don't want to be that guy (and take your time), but is there an ETA for a release?
[LG V20 Guides, News, & Discussion] ChazzMatt:
Wow.

Do me a favor... Say it. "This also applies to the V30."

I can read what I bolded, but would love to see it written out. ;)

Sent via open market LG US998 V30/V30+
[LG V20 Guides, News, & Discussion] pro_granade:
Why will this matter on bootloader locked versions? If you're on ARB1 will the ARB0 aboot for Dirtysanta even boot? If not, how do you root if the bootloader is still verifying everything before it boots?
[LG V20 Guides, News, & Discussion] BROKEN1981:
welp, you just pwned LG!

Hope to see you with a dev tag soon!
[LG V20 Guides, News, & Discussion] runningnak3d:
I will edit that post. I should have said: "Any LG model that can unlock their bootloader, or has an engineering aboot (G6 and down) or an engineering abl (V30 and up)".

That means that any V20 (since we have an eng. aboot), the H932 V30, and the T-Mo (don't know the model) G6.

I am working on a way to unlock bootloaders, without an eng. aboot / abl, but that is outside the scope of this thread -- well sorta. However, that depends on me getting direct writing working (MISC WRTE / COPY).

As to an ETA, I am going to duplicate my work on my H910, and then I am going to contact a few people to test. I don't need any volunteers -- I already have my list in mind [MENTION=5070414]Josh McGrath[/MENTION] you are one of them :)

To answer the next question that will come up -- why don't I just release it now? It is fairly complicated, and I want to remove some of that. As a result of it being complicated, it is very easy to brick your phone. I am AMAZED that I didn't.

-- Brian
[LG V20 Guides, News, & Discussion] Eliminater74:
I was thinking about diving back into the LG devices again, and was checking out all the current LG threads, and see this post in the V30 threads..... I must say your post caught my eyes..

good job man............

Hope it all works on next set of LG devices as well..
[LG V20 Guides, News, & Discussion] Josh McGrath:
[MENTION=3167089]runningnak3d[/MENTION]

Hey, pm headed your way. very important.

Damn PM aren't working for me as usual. So basically, I HIGHLY recommend removing your method details. LG sec team is actively watching this (and other xda) threads!!

I don't recommend anyone updating to Oreo until we know since the update should be soon. Just in case .
[LG V20 Guides, News, & Discussion] ChazzMatt:
Agreed.

[MENTION=3167089]runningnak3d[/MENTION], details aren't important right now, since you're going to package it anyway.

Sent via open market LG US998 V30/V30+
[LG V20 Guides, News, & Discussion] runningnak3d:
Thanks, but unfortunately it doesn't matter if they know how I figured it out .. once released they will try to patch it. I am not going to go into details about how they could, but it would not be easy, but not impossible.

Edit: BTW do the G6 and V30 still have sdcards?

-- Brian
[LG V20 Guides, News, & Discussion] Josh McGrath:
Yes, they both have SD cards.
[LG V20 Guides, News, & Discussion] pro_granade:
Okay so you can boot the engineering aboot regardless of the ARB version?
[LG V20 Guides, News, & Discussion] jcsww:
Yes, they do! Keep up the awesome work!
[LG V20 Guides, News, & Discussion] TheDannemand:
[MENTION=3167089]runningnak3d[/MENTION]: Wow, this is mind-blowing. While it may feel like "discovery by accident", most major discoveries do in fact occur when somebody work long and hard on a project (like you've done here) and suddenly stumble upon something they didn't expect. Congrats on the breakthrough!

V30 does indeed have SD.

Edit: Oh boy, a handful of faster replies to that question in the few minutes it took me to write this post :cyclops:
[LG V20 Guides, News, & Discussion] runningnak3d:
I am going to post instructions ASAP to test. The test will not give you root, but it is also safe. I have to make a file for each model, and I need some info.

I am posting this now in case you want to test because it will wipe your phone, so you need to back everything up.

The final version won't require a wipe, but again, I need model specific info first.

You don't need to reply if you want to help, and I will be creating a new thread for this test.

-- Brian
[LG V20 Guides, News, & Discussion] Moriatier:
goog to know that and really appreciate your wonderful work. Are you suggesting only the BL unlocked and TMO models are supported? Or all V30 variants?
[LG V20 Guides, News, & Discussion] jimenezboy:
You singlehandedly took on the entire LG Dev team and you've come out on top. Good work man. You're from another world.
[LG V20 Guides, News, & Discussion] jcsww:
Will you be linking to the new thread from this thread?
[LG V20 Guides, News, & Discussion] Nickvanexel:
Sorry if this is a stupid question. But would this allow to unlock the bootloader on sprint ls997 with zvc/zvd firmware. Im currently on the latest march 2018 security patch on zvd firmware. And with that said would i also then be able to convert to us996 to sim unlock my phone? I am interested in root as well but mainly trying anything to sim unlock.
[LG V20 Guides, News, & Discussion] pro_granade:
Probably. No one knows for certain yet. But probably.
[LG V20 Guides, News, & Discussion] bountyman334:
This is very exciting news...that also means downgrading to previous verisons?10s->10r->10o
[LG V20 Guides, News, & Discussion] Josh McGrath:
Arb isn't checked in LAF. THIs pretty much gurantees this will be patched soon
[LG V20 Guides, News, & Discussion] ph4nt0m117:
So.... ok what can we DO with TWRP once its in there? Just back up the rom and call it good? Whats the point when you don't have root?
[LG V20 Guides, News, & Discussion] darkknight1812:
You can flash supersu or magisk which will give you root.
[LG V20 Guides, News, & Discussion] Nickvanexel:
Okay just to clarify because i am still a bit confused. Been trying to piece together information from all of the different threads and posts on this forum but still mixed up a bit.

Apparently the dirty santa method, witch only works for zv7 or older firmware for the ls997, is capable of sim unlocking the phone. Witch part of the process actually accomplished that part? Does simply flashing the us unlocked variant firmware sim unlock the phone? Or is it a part of the exploit that accomplishes that?
[LG V20 Guides, News, & Discussion] pro_granade:
Part of the exploit.
[LG V20 Guides, News, & Discussion] Nickvanexel:
So even if this method works it wont help to sim unlock?
[LG V20 Guides, News, & Discussion] runningnak3d:
The engineering aboot is completely unlocked, that includes sim unlock.

Sorry, a little bit of RL distracted me last night. I will have the test instructions up in a couple of hours.

-- Brian
[LG V20 Guides, News, & Discussion] brossovitch:
Sorry if this was already asked....

Do you think this will work on fully updated devices?

For example my V30 (H932) is on 10D and my G6 (H872) is on 11G, will these work perhaps? Kind of assume you won't know.

However i also have an unused, non updated H932 soni assume that will be fine..
[LG V20 Guides, News, & Discussion] runningnak3d:
If it doesn't you will be able to roll back to a version that does work. Remember, ARB isn't checked on laf. The V30 is a little more interesting. I know copy2 was pulled even from the earliest version available, but I have not checked indirect. If indirect is pulled, they will have to flash laf from a V20 or G6 KDZ -- the RSA key that lafd uses (NOT to be confused with the RSA key in the CPU that is used to verify firmware on BOOT) to flash is the same across the G5, G6, V10, V20 and V30 for all models that I have checked. As a matter of fact other than a few changes to build.prop, the laf partition seems to be the same across all current LG devices.

There are 3 kinds of flashing that lafd supports:

Normal -- this is how KDZs are flashed and use the SIGN payload

copy2 -- this abuses MISC WRTE / COPY and I am still going to work on cracking this

indirect -- this flashes from the SD card (maybe others, but this is all I care about right now)

-- Brian
[LG V20 Guides, News, & Discussion] brossovitch:
Dude, I think I speak for everyone when I say, "I LOVE YOU!"

And donations aplenty for you sir!

✌️?
[LG V20 Guides, News, & Discussion] Josh McGrath:
Again, I gotta say awesome work ,Brian!