yashsingh1/xdaforums huggingface dataset:
[LG V20 Guides, News, & Discussion] storm68:
That is just amazing. Your a genius... Thank you so much for your devotion and time.
[LG V20 Guides, News, & Discussion] runningnak3d:
You welcome, but the genius work is still to come :)

Unfortunately it looks like I am going to have to pay for Hopper (the arm64 decompiler). The trial only gives you 30 minutes and then you have to reload -- and that is a PAIN.

[LAF] not found access list. 0000g

That right there is why I am going to have to reverse lafd. It appears that there is an access list that is stored, but it doesn't appear to be per partition. I sent a valid access list straight from an LG UP dump, and I can't get it to write. 0000 above was just me testing something.... :)

Anyway -- more to come.

-- Brian
[LG V20 Guides, News, & Discussion] JerichoAbles:
Thank you for giving the rest of us V20 owners hope
[LG V20 Guides, News, & Discussion] runningnak3d:
So - step1 - DONE! I can pull an image off a phone.

I know -- not really the way we want to go, but getting the ability to DUMP partitions is just as important as being able to write them. Also, I don't risk blowing up my phones by dumping data. I am going to have to do this a couple of times and do diffs of dumps that I make the "normal" way to make sure that they are identical all the time and there isn't some weird timing thing that I missed. Also, can't just issue an OPEN command, and then a READ command and have it go -- YEA! HERE have a partition. Even after all the setup is done for the READ to start, you can only read 4megs at a time. I could probably crank that up to 8megs, but anything over 8 megs locks up lafd. I am guessing it is some kind of buffer limit. Anyway, have to read, and then concatenate, wash / rinse / repeat. But there is another PITA. I know how big a partition is because I already have rooted phones so once I figured out that you can't read past the end of the block or ERRRR lafd locks up. I still have to find a way (and I KNOW it is there because when LG UP runs lafd dumps out all kinds of size info) to read the size. But I still have megs and megs of packet dumps to go through. Once I have the ability to get the size of partitions, then it will be time to start working on writing them. That actually won't be as hard now that I know how to read them.

Once we have all three, I am now 100% confident that every single LG phone currently on the market will be rootable. Some will require a little more research. For example, trial and error getting a boot loader unlocked. The good news is that as long as you have a KDZ you won't brick your phone, and when it is figured out for one model, it is for all of the same version. So, for example, I did for the H910 -- so all V20s can have their boot loaders unlocked without the engineering aboot.

Anywho -- that is enough playing tonight.

EDIT: I will open up a github and add ALL kinds of documentation to the wiki, but for now, just a little insight as to what is needed:

You have a handful of commands:

HELO

EXEC

READ

OPEN

KILO CENT

KILO METR

INFO GPRO

INFO SPRO

CLSE

SIGN

OPCM CHEK

MISC WRTE

CHCK CLER

WRTE

-- Brian
[LG V20 Guides, News, & Discussion] Zacharee1:
You're a TMO employee? How far up?
[LG V20 Guides, News, & Discussion] BROKEN1981:
I am hoping that you can shed some light on a question I have. When I had the S5, I used mobile Odin pro to always update stock firmware.

Now there is flash fire. How come that can't be used to update a rooted phone to the newest stock version?

I ask you since I never get that question answered in the flash fire thread. Figured you would more than likely know.
[LG V20 Guides, News, & Discussion] OfficialVillager:
Not sure I should say. But I'm TPR
[LG V20 Guides, News, & Discussion] Zacharee1:
TPR?
[LG V20 Guides, News, & Discussion] loopytee:
I get what your meaning but I think [MENTION=631273]Chainfire[/MENTION] is more of Yoda then Sith Lord. Chainfire is helping to free us from the dark side of locked down hardware/software. I just have a thing about complimenting people by comparing them to evil things. Now back to the regular thread.....
[LG V20 Guides, News, & Discussion] storm68:
Lol. It wasn't to be taken serious. It's a joke. Breathe.... (Vader sound) :laugh:
[LG V20 Guides, News, & Discussion] wAFFLES017:
This is probably nothing but you never know. I have been using only LG devices since the g2 and personally have not seen or even heard of flashing this way. Figured its worth a shot. Mainly curious as to the modded files. At least from my understanding reading those intructions you do ended up changing some modified files to the original program?

http://www.hardreset.info/devices/lg/lg-v20/faq/firmware-flash/
[LG V20 Guides, News, & Discussion] OfficialVillager:
Hows it going man? Havent heard updates in a few days. Actively following this.
[LG V20 Guides, News, & Discussion] runningnak3d:
Well, we still have not gotten a successful write. However, the WRTE header was being sent with every packet instead of every 3 megs -- dunno how I missed that. That was discovered yesterday...

OPEN

READ

INFO GPRO

INFO SPRO

SIGN

OPCM CHEK

MISC WRTE

CHEK CLER

Have all been fully decoded and documented, that just leaves solving this issue with WRTE. There are literally no other opcodes that are sent for writing.

More news coming soon....

-- Brian
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=7421209]MicrosoftDOS[/MENTION]

Search for:

VENDOR_ID_LG = 0x1004

and change it to

VENDOR_ID_LG = 0x18d1

If that gets you in, do me a favor a type dmesg. If that works, copy the entire output to a file:

lglaf -c 'dmesg' > dmesg.txt

Zip that up and post a link.

Unfortunately, all MM and N devices use LAF protocol 1.0.0.4 so you won't be able to root until the WRTE issue has been resolved. As for who you can thank for the device ID being Google instead of LG -- that would be T-Mobile.

-- Brian
[LG V20 Guides, News, & Discussion] steadfasterX:
There is already a PR in preparation about this (check the Install topic in the README):

https://github.com/steadfasterX/lglaf/tree/feature/udevrules

This will also add your device above (as many others)

I'm sorry but I have a user with a LG g4 (H811) who uses MM and the protocol is 1.0.0.0 ! Which is a nightmare for my detection if i need to do the chall/response or not..
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=5545101]steadfasterX[/MENTION] RE: user with MM and 1.0.0.0. Ask them if when they upgraded to MM they only upgraded boot and system. I bet the answer will be yes. :)

Also, did not see that PR -- sweet

-- Brian
[LG V20 Guides, News, & Discussion] steadfasterX:
KDZ flash by lgup. ah and now i have another user with an

early

MM version but on the H815 which seems to have the same issue.. My H815 with the latest MM has 1.0.0.4 though.

Edit:

And to be honest even when the user would be able to flash Those both partitions or just the Bootloader stack which is not possible on our devices when it is locked but ok let's say it would be possible then it is still the case that I have older protocol version which requires challenge response so we need to have another identifier than the protocol version as this is not a valid identifier for it unfortunately.

.
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=7421209]MicrosoftDOS[/MENTION] pass it --cr and --rawshell
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=7421209]MicrosoftDOS[/MENTION] You must use python3.

Also, sorry I didn't reply earlier. It would be pointless for me to have a repo now, when I started working on this, I had to add all kinds of hacks to get the challenge / response working and UFS support. All of that has been fixed in the lglaf repo in a MUCH more elegant way, and I if I don't hear back, I will open a PR to add UFS support -- although I am still not happy with my solution for auto-detection.

As for making a repo with the decompiled code, I am hesitant to do that in case LG wants to be total a**holes. I would be glad to share my work with you (or anyone else) in private though. I can (and will) publicly share all the packet sniffs that I have used. Also, there will be a PR to update the documentation on the lglaf repo.

For example, in the WRTE opcode, there are flags that get set for the order of the packets:

opt1=0x18 // first packet

opt1=0x09 // all the middle packets

opt1=0x29 // the last packet

None of that is currently implemented.

-- Brian
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=7421209]MicrosoftDOS[/MENTION] If you want, feel free to join us on irc: irc.freenode.com / #lglaf

Even if my next test fails (I added the proper packet flags for start / middle / end -- also adding compression), I will go ahead and fork the lglaf repo and push all my changes that way people like yourself can see the progress. --dump, and --list work great ... lol :)

-- Brian
[LG V20 Guides, News, & Discussion] BROKEN1981:
Well I did actually get a response.

I'm just not sure what to say over the phone and how to handle this.
[LG V20 Guides, News, & Discussion] BROKEN1981:
So after I emailed the CEO of TMobile, I did get a response. I'm attaching 2 screenshots. How should I go about doing this?
[LG V20 Guides, News, & Discussion] runningnak3d:
Small update. So after adding compression, and fixing the write_type flags, I am now able to get farther:

[LAF] dec flush offset = 0x1806000, fd = 39, whence = 0
[LAF] not found hash. not allow write to device.
[LAF] hex dump start address = 0x7292308148 count = 32
[LAF] [00000:0x7292308148] [ 31 e1 0d e0 da 8f 41 f1 77 5b 67 d4 08 d8 35 78 ] 1.....A.w[g...5x
[LAF] [00010:0x7292308158] [ 3f 44 29 d3 e9 2a 4f 4f 21 cc df ab ac 6c 1d 9e ] ?D)..*OO!....l..

What makes no sense is that I am using the exact payload for the SIGN opcode, and I am flashing the stock recovery partition from the KDZ that it was extracted from. So, this should be working!!

Obviously once this IS working, more work will have to be done to flash non-stock partitions.

This WILL be solved! Back to the grind :)

EDIT: I have tried all 9 levels of compression that zlib.compress has in case the hash is on the compressed data and not the uncompressed.

-- Brian
[LG V20 Guides, News, & Discussion] runningnak3d:
Because I am so irritated that I don't feel like making a new post, this copy / pasted from IRC:

Yes, folks with that realization, it would only be possible to make this work if the RSA cert leaked. So, unless one of you know someone at LG or a carrier that is willing to provide the cert, this is done.

I am sorry if I got some people's hopes up. Heck even though both of my phones are rooted, I was ecstatic. This is a major let down.

Just to be clear, this is no longer a case of not understanding the protocol. This is a case of fully understanding it, and not having the RSA cert to make it work.

Bravo LG. This was a really good security implementation.

And to anyone that thinks we can just recreate the RSA cert using the keys, hashes, etc... if that were possible, then the Internet would be a whole lot less secure.

-- Brian
[LG V20 Guides, News, & Discussion] ThrIsNoSpork:
That's a real bummer but thank you for putting in all that work anyway.
[LG V20 Guides, News, & Discussion] runningnak3d:
Just one last follow up, the private key that is used to decrypt the SIGN hashes is the key that is in the CPU. Before anyone get the bright idea of just randomly reading QFPROM to try and extract it, remember, the TZ has tamper detection and will blow the tamper fuse.

EDIT: one last update. We are going to look for an exploit in lafd. If we can find a buffer overrun that has it return SIGNED no matter what is sent, this is still possible. Don't hold out hope / hold your breath. For one things, the exploit would have to make lafd ignore the SIGN and not corrupt the WRTE data stream, or that would be a big ol' brick.

-- Brian
[LG V20 Guides, News, & Discussion] SJMarty:
[MENTION=3167089]runningnak3d[/MENTION], I am a new H918 owner and just read through this and several other V20 threads. Your dedication and tenacity to this cause are immeasurable and very admirable.

Last week, I purchased 2 H918 phones. They were just delivered today...

One is brand new, sealed in the box, and running 10d.

The other is used and running 10p.

I would like to help in any way I can. Would information from either of my two phones help you? If so, just let me know how to get it and consider it done. If not, is there anything that I can do to provide you with information, resources, etc.?

Thank you again for the incredible amount of time you have committed already.

-Steve
[LG V20 Guides, News, & Discussion] BROKEN1981:
I just want to say thank you for the hard work and effort.

Is there anyway we can exploit the security like we did with dirty cow?
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=5631635]BROKEN1981[/MENTION] That is definitely being looked at. It won't be like dirtycow though -- that was a kernel exploit and we had access with adb to push code. Actually, think dirtycow but remotely over USB.

In download mode (LAF) there is a very limited Linux environment -- pretty much just enough to run lafd. However, it is locked down with SELinux, and other security measures.

So, to find an exploit, we are having to decompile the lafd daemon and go through it with a fine tooth comb looking for stack heap or buffer overrun in the communications stack. Hopefully, they screwed up memory allocation on one of the opcodes, and we can send a malformed opcode, and in the payload send a memory patch that will cause lafd to ignore signature checking.

We can't modify ANYTHING not in RAM or LAF would fail the integrity check done by the bootloader if the phone was rebooted before being rooted (IE: when we fail the multiple times it is going to take -- if it is even possible), and you would have a total brick since the phone wouldn't boot, and you have no download mode.

-- Brian
[LG V20 Guides, News, & Discussion] BROKEN1981:
Anyone else check this thread over 10 times a day? LoL
[LG V20 Guides, News, & Discussion] SJMarty:
No. Probably about 16x for me. I have to keep checking to make sure XDA's e-mail notifications are working. :D
[LG V20 Guides, News, & Discussion] storm68:
Yep! Lol
[LG V20 Guides, News, & Discussion] BROKEN1981:
Ok so, I had gotten back a phone call following up on my complaint.

I have good news and bad news. Bad news first.

Everyone wants their device rooted but never wants to make an effort to help, no matter how minor it is. Then you have the people who are rooted, and don't care to even help the community.

[MENTION=3167089]runningnak3d[/MENTION] has taken this project solo. He asked many times for help but other well known devs just don't care.

As for me, I'm just a dumb Italian from Brooklyn who works contracting. I just want to do what ever I can, no matter how small it is.

This is were the community needs to get involved, send an email as well as a phone call.

The lady I spoke to was very knowledgeable. I told her how I felt about rooting, flashing a custom ROM and how an unlocked bootloader makes me feel as if I own the phone. I told her how Verizon locks down the phone and loads it up with bloat that I can't get rid of.

Her response to me was either she knew about the subject of rooting and the use of TWRP, or she read up on it so she can better assist me. If that's the case, my complaint is being taken seriously.

If she actually knew about rooting and flashing TWRP, that's still very good because the next part will explain why.

I let her know that it was TMobile that took out the fast boot commands. She did not deny that. She also knew about ABR. She also explained to me the reason I can't simply do a device swap with 10k firmware is because they have no way of knowing what firmware is on the device being sent out.

She told me many Android users love Android verse iOS because of the level of customisation. That's the reason many users like to pick LG, also it's good for app developers.

Now I'm trying to recall my entire half hour conversation but I'm getting side tracked by people around me. So let me short hand this.

She said if many users call to complain, they will take a better look at it. She is going to forward this to the team and possibly next update the fastboot commands will be put back. So either way it's a win win.

So, to make my point clear to the community of XDA, people who are rooted and people who aren't rooted will need to contact this women.

In reality, I know most people will not want to take out 10 minutes of their day to do such a simple task. They would rather just let [MENTION=3167089]runningnak3d[/MENTION] do his thing and sit back and profit off his hard work.
[LG V20 Guides, News, & Discussion] BROKEN1981:
Yeah thank you. That helped me while speaking to the lady earlier today.
[LG V20 Guides, News, & Discussion] storm68:
I will definitely give Ms Flores a call after the holidays.
[LG V20 Guides, News, & Discussion] BROKEN1981:
I would suggest to email as well. Thanks for contacting her!
[LG V20 Guides, News, & Discussion] popper668:
mistake
[LG V20 Guides, News, & Discussion] jcpowell:
Sadly, it's foolish to think some phone calls and emails will change anything...

Not being an ass, they just don't care and will never care.

It is what it is.
[LG V20 Guides, News, & Discussion] BROKEN1981:
Actually not true. She is very high up, while having a half hour conversation.
[LG V20 Guides, News, & Discussion] firstblud:
Anyone want to make a template of what to Email ms flores? Sending an email is easy so why not.
[LG V20 Guides, News, & Discussion] laneyyy:
I'm happy to help you out by sending an email either way, but will it affect this project or people outside of T-Mobile? From what I understand, best case is you get ADB commands back for T-Mobile V20s and thats it
[LG V20 Guides, News, & Discussion] jcpowell:
It's just PR...
[LG V20 Guides, News, & Discussion] storm68:
No problem. I'll do that tonight. I figured even if nothing comes out of it I can say I also tried.
[LG V20 Guides, News, & Discussion] Zacharee1:
There's a broken tower in my area that was supposed to get LTE almost a year ago. We talked to the actual owner of the tower recently, and he told us that my constant berating of the TMO reps about the tower was actually getting them to do something. You just have to nag nag nag nag nag.
[LG V20 Guides, News, & Discussion] jcpowell:
I'm a tower climber/ tech and I promise you that was not what got techs on that tower.
[LG V20 Guides, News, & Discussion] BROKEN1981:
Well the time you devoted to telling me it's not going to work is well appreciated.

I guess it's less effort then just doing an email or phone call.......
[LG V20 Guides, News, & Discussion] BROKEN1981:
Was kinda hoping we had a Christmas present. LOL
[LG V20 Guides, News, & Discussion] storm68:
Lol same here. :laugh:
[LG V20 Guides, News, & Discussion] BROKEN1981:
I wonder if I should try this. It was featured on XDA
[LG V20 Guides, News, & Discussion] dudeawsome:
if you wanna be our test subject go for it

also see how it does it so we can reverse it and finally have a root method
[LG V20 Guides, News, & Discussion] laneyyy:
One-click root and kingroot both say they can do it but I'm not game enough to try
[LG V20 Guides, News, & Discussion] LeftyGR:
Can't tell what app this is from your pics. Got a link or a name we can search for?

No animals were harmed composing this post. Except pigs, because bacon is delicious!
[LG V20 Guides, News, & Discussion] jcpowell:
Don't pay them a dime.

As for kingo root etc.. those one-clicks will not harm your device if they fail, which they will. What they might do is leave traces of themselves on your device either way.
[LG V20 Guides, News, & Discussion] BROKEN1981:
If I can get back to 10P, I think I would have better success
[LG V20 Guides, News, & Discussion] storm68:
Any luck?
[LG V20 Guides, News, & Discussion] BROKEN1981:
Sadly no
[LG V20 Guides, News, & Discussion] storm68:
Thanks for trying
[LG V20 Guides, News, & Discussion] SJMarty:
[MENTION=3167089]runningnak3d[/MENTION], is there anything those of us that are not developers can do to help with this?
[LG V20 Guides, News, & Discussion] wAFFLES017:
edit: answered my own question. and don't see a way to delete comment.
[LG V20 Guides, News, & Discussion] BROKEN1981:
Happy New year's all!!!!
[LG V20 Guides, News, & Discussion] dudeawsome:
you too bro Happy New Years
[LG V20 Guides, News, & Discussion] runningnak3d:
First ... Happy new year.

As I sit here in a bar enjoying a bloody Mary, it dawned on me that we don't need to extract the key from the CPU, lafd does that for us. So, what we need is a debugger attached to lafd when it does the signature verification and read it out of memory.

Once we have that key, we can use any other key to generate the hash and then the signature ... lafd will decrypt it since this is asymmetric key signing.

I can compile gdb and attach it to lafd. You guys may be getting a late Xmas present.

I am posting this now because I want someone to punch a hole in the idea if I am missing something obvious. I mean why didn't I think of this sooner?

Edit: In case someone with G6 or V30 reads this, it won't work for you. You have to have an already rooted device so you can make a change to the LAF partition and attach gdb.

Edit2: There is a chance that for now they are using the same key. Hmmm
[LG V20 Guides, News, & Discussion] storm68:
That is awesome news. Hopefully something else doesn't snag. Man I really do appreciate your dedication and time. Thank you x10.
[LG V20 Guides, News, & Discussion] SJMarty:
Happy New Year to you, too!

I agree that this is fantastic news. I was worried after your last post that you might be done with this. I am also very appreciative of your continued work and dedication to rooting this thing.

I'm not a developer so I'm not sure what help I can offer you. If you think of something, please don't hesitate to ask.

-Steve
[LG V20 Guides, News, & Discussion] runningnak3d:
Well, if any of you guys know v30 or g6 owners, I just checked their aboot and they have the same key (at least the non t-mobile variants -- T-Mobile are super d**ks and use their own key).

If any of them are proficient in Linux and debugging -- get them to help, then we can ALL have root (well, again, except for the T-Mobile versions of the v30 and g6).

Email them, PM them, SMS them, smoke signal them to join: irc.freenode.net / #lafd

-- Brian
[LG V20 Guides, News, & Discussion] runningnak3d:
[MENTION=6814590]askermk2000[/MENTION] If you get this, I need your help. I have no idea why I can't rebuild an initrd that boots -- it is the same problem I have had for months now, but I need you to recompress an initrd for me.

-- Brian
[LG V20 Guides, News, & Discussion] askermk2000:
[MENTION=3167089]runningnak3d[/MENTION] - pm sent.
[LG V20 Guides, News, & Discussion] BROKEN1981:
When you crack this, they better feature it on XDA.
[LG V20 Guides, News, & Discussion] runningnak3d:
So here is an update. The LAF environment was way too locked down, so I figured what the heck -- let's see what happens if I copy lafd over to a TWRP environment. Sure enough, it runs with the right kernel / kernel modules.

But when it fires up I lose access from adb, so I used the terminal built into TWRP as a test and it works. But, trying to use gdb on a touchscreen is next to impossible, so I am building a new initrd that has networking, and sshd.

So, why don't I just run lafd from a normal booted Android environment that has sshd? Yea, LG thought of that, and has checks in the lafd binary and kernel module to prevent that from happening.

I have been able to test lafd with gdb attached though, and it works -- they didn't put any checks in for debuggers.

-- Brian
[LG V20 Guides, News, & Discussion] storm68:
Great news! But, seems like the risk is higher now.
[LG V20 Guides, News, & Discussion] BROKEN1981:
Man, I am really happy you enjoy a challenge! They better feature your work on XDA. Most of the stuff they write about is worthless crap like Bill Gates using an Android phone......
[LG V20 Guides, News, & Discussion] xXCoolGuYXx:
Glad to see people still working on this phone you guys are what makes xda thanks for it all